Blahalla

As the Pentagon Pushes for Battlefield AI, Some Military Leaders Urge Caution

www.securityweek.com · a month ago

The Pentagon advances AI integration into battlefield tools to rapidly identify targets and accelerate strikes. However, leaders like USSOCOM's Admin. Frank Bradley caution that humans must maintain control over all decisions involving lethal force. Furthermore, Special Operations Command personnel suggest leveraging AI mainly for reducing administrative tasks and lowering operator workload.

Microsoft confirms outage affecting MFA, My Sign-Ins platform

www.bleepingcomputer.com · a month ago

Microsoft is working to address an ongoing incident preventing customers from setting up multi-factor authentication (MFA) or accessing the My Sign-Ins platform.

Microsoft fixes outage affecting MFA setup, MySignIn service

www.bleepingcomputer.com · a month ago

Microsoft is working to address an ongoing incident preventing customers from setting up multi-factor authentication (MFA) or accessing the My Sign-Ins platform.

The Security Growth Platform: Why MSPs Are Moving Beyond vCISO Tools

thehackernews.com · a month ago

Three years ago, the practical question for an MSP building a cybersecurity practice was which "vCISO platform" to buy. The term was good shorthand for the work at the time: assessments, advisory, reporting, maybe a compliance module bolted on the side. The work has since outgrown the descriptor. A Security Growth Platform is the more precise name for what MSPs and MSSPs need from the software

19-Year-Old Linux Kernel Vulnerability Exposes Systems to Root Access

www.securityweek.com · a month ago

A vulnerability in the Linux kernel's CIFS subsystem, named CIFSwitch, lets low-privileged users gain root access across multiple distributions. Attackers exploit this flaw by bypassing origin checks and calling requestkey directly, forcing a process running as root to execute attacker-controlled code via manipulated NSS modules.

Iranian Hackers Hijack AppDomainManager to Bypass EDR

gbhackers.com · a month ago

Iran-nexus APT group Screening Serpens upgrades its tradecraft by hijacking AppDomainManager in.NET apps, disabling ETW telemetry to bypass EDR tools. The attackers pair this exploit with DLL sideloading and highly tailored social engineering lures.

Microsoft fixes KB5089549 Windows security update install issues

www.bleepingcomputer.com · a month ago

Microsoft has resolved a known issue causing installation failures and 0x800f0922 errors when deploying the May 2026 Windows 11 security update (KB5089549).

Microsoft: No Lawsuits Against Researchers in Nightmare-Eclipse Row

gbhackers.com · a month ago

In April 2026, researcher Nightmare-Eclipse published six zero-day vulnerabilities affecting core Windows components like Defender and BitLocker. After facing criticism for its aggressive initial response to the disclosures, Microsoft issued a clarifying statement.

Recent Palo Alto Networks Vulnerability Exploited for Weeks

www.securityweek.com · a month ago

Exploitation of CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks GlobalProtect portals, was reported. CISA added the flaw to its Known Exploited Vulnerabilities catalog. Rapid7 observed multiple attack waves using forged cookies from various hosting providers.

OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack

thehackernews.com · a month ago

Cybersecurity researchers have disclosed details of a new malicious supply chain campaign that's targeting developers using OpenAI Codex through a legitimate-looking remote web UI. The tool, named codexui-android, is advertised on GitHub and npm as a remote web UI for OpenAI Codex, attracting over 29,000 weekly downloads. The package is still available for download from the repository. What

Critical WP Maps Pro Flaw Actively Exploited to Create Admin Accounts

thehackernews.com · a month ago

Threat actors are attempting to actively exploit a critical security flaw impacting WP Maps Pro, a WordPress plugin that has had over 15,000 sales on the Envato Market, to create malicious administrator accounts on susceptible sites. WP Maps Pro allows site owners to embed customizable Google Maps and OpenStreetMap with markers, listings, and advanced location features on WordPress sites. It is

Iran-Linked Hackers Wipe IT and Recovery Systems in Middle East Cyberattack

gbhackers.com · a month ago

Iran-linked hackers, linked to Black Shadow, executed the "Ababil of Minab" campaign targeting multiple Middle Eastern nations. The attackers systematically wiped IT infrastructure and recovery systems by abusing legitimate administrative tools like VMware vCenter and SQL Server Management Studio.

Meta AI Vulnerability Allegedly Enables Instagram Password Resets

gbhackers.com · a month ago

A vulnerability in Meta AI's support system allowed attackers to take over Instagram accounts by tricking the chatbot into sending password reset codes without verifying user identity. Security researchers reported the issue, which bypassed traditional security layers and targeted premium handles for resale.

6 critical security gaps every CISO must address

www.csoonline.com · a month ago

A Proofpoint report indicates that one-third of CISOs lack adequate data protection, and 58% feel unprepared for a cyberattack. Cybersecurity leaders must shift focus from protecting IT systems to ensuring overall business resilience when facing incidents like the Change Healthcare breach.

Microsoft KB5089573 Fixes Windows 11 Patch Tuesday Install Failures

gbhackers.com · a month ago

Microsoft released cumulative update KB5089573 for Windows 11, addressing installation failures during recent Patch Tuesday deployments. This patch also bundles a servicing stack update (KB5092734) and upgrades several on-device AI components, including Image Search and Semantic Analysis.

Windows Netlogon 0-Click RCE Vulnerability Under Active Exploitation

gbhackers.com · a month ago

Researchers confirmed a zero-click vulnerability, CVE-2026-41089, affects Windows Netlogon, allowing unauthenticated remote code execution on domain controllers. Exploiting the service needs no user interaction and grants SYSTEM-level privileges, enabling complete domain compromise.

Hackers Target Signal Users to Steal Backups in New Attack Wave

gbhackers.com · a month ago

Attackers are running a phishing campaign impersonating "Signal Support" to trick users into revealing their encrypted backup recovery keys. These fraudulent messages claim data loss requires urgent action, directing victims to copy and paste their unique recovery key within the chat.

WP Maps Pro bug exploited to create admin accounts on WordPress sites

www.bleepingcomputer.com · a month ago

Hackers are targeting WordPress websites running a vulnerable version of the WP Maps Pro plugin, which allows creating rogue administrator accounts without authentication.

Dutch Authorities Dismantle Botnet Linked to 17 Million Infected Devices

thehackernews.com · a month ago

Dutch authorities have announced the takedown of a botnet that enslaved millions of infected devices, including computers, tablets, smartphones, and IoT devices, to carry out malicious attacks. The bot network, per the Dutch Politie and the National Cyber Security Center (NCSC), consisted of at least 17 million infected devices. More than 200 servers located in the Netherlands acted as the

Joby Demonstrated its Air Taxi in Manhattan, but You Can’t Fly in It Yet

www.nytimes.com · a month ago

Aviation start-ups and the Trump administration want to replace helicopters with electric aircraft, but the new vehicles still have to pass arduous tests before the public can use them.

Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks

www.bleepingcomputer.com · a month ago

Palo Alto Networks is warning that hackers are now exploiting a PAN-OS GlobalProtect authentication bypass flaw, tracked as CVE-2026-0257, in attacks attempting to breach corporate networks.

Russian Spies Are Aggressively Seeking Western Technology as Sanctions Bite, Officials Say

www.securityweek.com · a month ago

Moscow’s agents are building fake companies, recruiting middlemen and deploying cyber spies and hackers who gather information that could be used to attack key infrastructure.

Exploit Code Published for Critical Flowise RCE Vulnerability

www.securityweek.com · a month ago

The one-click vulnerability allows attackers to execute arbitrary code on self-hosted Flowise servers by tricking users into importing a malicious chatflow.

New CIFSwitch Linux flaw gives root on multiple distributions

www.bleepingcomputer.com · a month ago

A newly discovered local privilege escalation vulnerability dubbed 'CIFSwitch' in the Linux kernel could allow attackers to forge CIFS authentication key descriptions, abuse the kernel's key request mechanism, and gain root privileges.

Powerful A.I. Super PACs Duel Over the Midterms: ‘This Is a War’

www.nytimes.com · a month ago

One is allied with Anthropic. The other is tied to OpenAI. They’re both spending millions to influence the midterms, and they’re leaving a trail of fearful candidates and canceled ads in their wake.

Digital Trap: Iran Uses Selective Internet Restoration to Track and Arrest January Protesters

irannewswire.org · a month ago

Authorities are accused of systematically deleting protest victims within Iran. There are allegations that this effort is part of a broader war against demonstrators. These actions suggest governmental efforts to erase evidence related to the unrest. No CVEs were mentioned in the provided text.

Palo Alto PAN-OS Authentication Bypass Vulnerability Actively Exploited in the Wild

gbhackers.com · a month ago

A critical authentication-bypass vulnerability affecting Palo Alto Networks PAN-OS and Prisma Access is being actively exploited by malicious actors. In response to mounting attacks, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026. While the flaw carries a medium CVSSv4 score, security researchers at

PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation

thehackernews.com · a month ago

Palo Alto Networks has warned that a recently disclosed medium-severity security flaw impacting PAN-OS and Prisma Access has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-0257 (CVSS score: 7.8), refers to a case of authentication bypass that could be exploited by bad actors to set up VPN connections. "Authentication bypass vulnerabilities in the

Google Chrome’s DBSC Now Generally Available to Prevent Account Takeovers

gbhackers.com · a month ago

Google has officially made Device Bound Session Credentials (DBSC) generally available for the Chrome browser on Windows. This architectural upgrade delivers a robust defense mechanism against one of the most pervasive threats in the modern cybersecurity landscape: session cookie theft and token exfiltration. Previously restricted to beta testing for Google Workspace environments, DBSC is now

SideCopy Deploys Persistent XenoRAT Against Afghanistan Finance Ministry

gbhackers.com · a month ago

Pakistan-linked threat actor SideCopy has launched a highly targeted spear-phishing campaign against Afghanistan’s Ministry of Finance (MoF). The operation surgically targets all 34 provincial revenue directorates, operating under the broader Transparent Tribe (APT36) umbrella. According to threat intelligence reports from Seqrite, the campaign culminates in the deployment of a customized XenoRAT 1.8.7 implant that beacons

Russia-aligned crime group Greyvibe extensively uses AI in attacks

www.csoonline.com · a month ago

Researchers uncovered Greyvibe, a Russian-aligned group that is extensively using large language models for cyberattacks targeting organizations in Ukraine. The group conducts intelligence gathering through spear phishing, fake websites, and ClickFix style lures. They developed custom malware including the PowerShell remote access Trojans PhantomRelay and LegionRelay, and the Android spyware FallSpy. Additionally, the group observed using various custom scripts for obfuscating and loading malware in their attacks.

Malicious npm packages abuse dependency confusion to profile developer environments

www.microsoft.com · a month ago

A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and detection opportunities to help organizations identify and disrupt related activity.

Microsoft and security researcher’s dueling posts about cybersecurity disclosures get nasty

www.csoonline.com · a month ago

A cybersecurity researcher publicly accused Microsoft of inappropriate handling and humiliation regarding vulnerability disclosures, referencing CVE-2026-45585. Microsoft countered these claims by stating that uncoordinated disclosures create unnecessary real-world risk for unpatched systems. Despite the disagreement, a Microsoft executive announced the company would adapt its security processes as conditions change. The debate underscores fundamental industry tensions over the proper timing and policy of vulnerability reporting.

Massive Blue Origin rocket explosion gives edge to Elon Musk in space race

www.washingtonpost.com · a month ago

The destruction of Jeff Bezos's New Glenn rocket clouds NASA’s lunar timeline and deepens reliance on SpaceX, as the U.S. races China to the moon.

What’s Next for Blue Origin After Rocket Explosion

www.nytimes.com · a month ago

Jeff Bezos was gaining ground on Elon Musk’s SpaceX and Starlink. Thursday’s rocket explosion on a launchpad creates a major setback.

Friday Squid Blogging: Another Squid

www.schneier.com · a month ago

Someone named “Squid” seems to be a “ West Country legend.” As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

A practical checklist for evaluating npm packages (supply chain attacks, slopsquatting, etc.)

blog.gaborkoos.com · a month ago

Developers must be highly cautious when using open source packages due to increasing supply chain risks and deep dependency trees. A growing threat called slopsquatting occurs when malicious actors register package names suggested by artificial intelligence code assistants. To assess a package, one must verify active maintenance by examining open issues and filtering for human-written, meaningful code commits. Additionally, checking for a consistent release cadence and reviewing the changelog indicates the author's care for the end user.

Name That Toon: Mark of (Cybersecurity) Progress

www.darkreading.com · a month ago

As part of Dark Reading's 20th anniversary package, we asked readers for a cybersecurity-related caption that captures their thoughts about the industry's last two decades.

Introducing Keyhog: The First GPU Accelerated secret scanner

santh.dev · a month ago

Keyhog is a credential harvesting tool designed to capture sensitive data and passwords from a system by monitoring keystrokes. This type of malware operates by recording user input, allowing attackers to steal critical login credentials. To mitigate the threat, experts recommend the use of isolated virtual machines and advanced network monitoring solutions. Furthermore, implementing robust multi factor authentication greatly limits the damage caused by compromised passwords.

ChatGPT share links abused to host fake outage pages to deliver malware

www.bleepingcomputer.com · a month ago

Threat actors are abusing ChatGPT's content-sharing feature to display fake OpenAI outage pages that direct users to download malware disguised as the ChatGPT desktop application.

California AG sues 23andMe over 2023 breach exposing health data

www.bleepingcomputer.com · a month ago

California Attorney General Rob Bonta filed a lawsuit against 23andMe, now Chrome Holding Co., over the company's failure to protect sensitive customer genetic and personal information.

ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface

thehackernews.com · a month ago

Cybersecurity researchers have disclosed details of a vulnerability in OpenAI ChatGPT that leverages the artificial intelligence (AI) assistant's implicit trust in Markdown links and images to trigger prompt injections and open the door to phishing attacks. The technique has been codenamed ChatGPhish by Permiso Security. "The chatgpt.com response renderer trusts Markdown links and Markdown

Dexcom Warns Stolen G7 Glucose Sensors May Pose Infection, Reading Risks

www.techrepublic.com · a month ago

Dexcom says stolen G7 sensors from two scrapped lots were sold through unauthorized channels, creating infection and reading-failure risks.

In Other News: Trump Mobile Data Breach, FIFA World Cup Phishing, CISA Responds to Supply Chain Attacks

www.securityweek.com · a month ago

Noteworthy stories that might have slipped under the radar: Trump Mobile exposes customer data, phishers target the 2026 FIFA World Cup, CISA responds to recent supply chain attacks.

DNS-AID will make AI agents easier to discover, says Linux Foundation

www.csoonline.com · a month ago

The Linux Foundation is promoting the DNS-AID project, an extension designed to help AI agents discover and communicate over the existing open Domain Name System. This standard method allows agents to use DNS as a global vendor neutral directory, eliminating reliance on proprietary agent registries. The proposal suggests domain owners utilize a specific well known address to serve as a starting point for locating other agents. This approach is intended to keep agent discovery scalable secure and fully compatible with underlying internet protocols.

As Global Powers Explore Humanoid Robots, Cyber-Risk Looms

www.darkreading.com · a month ago

The future of cybersecurity is germinating, as nation states vie for dominance in the embodied AI market and its supply chain.

Carnival Data Breach Exposes Data of Nearly 6 Million Customers

www.techrepublic.com · a month ago

Carnival says a data breach exposed personal information of nearly 6 million customers after a social engineering attack tied to a single employee account.

Certifiably random: Swiss researchers claim perfect random number source

www.csoonline.com · a month ago

Researchers in Switzerland claim to have created a perfect random number generator using quantum superconducting chips and a thirty meter microwave guide. The device overcomes systematic errors and biases found in traditional or current quantum random sources. By utilizing quantum entanglement created by microwave photons, the process generates a perfectly random sequence of zeros and ones. This breakthrough technology can certify true randomness for applications like cryptographic key generation and blockchain services.

Charter Communications Data Breach Could Impact Nearly 5 Million

www.securityweek.com · a month ago

The notorious ShinyHunters extortion group leaked over 42 million records allegedly stolen from Charter in April.

Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit

thehackernews.com · a month ago

An unknown threat actor has been observed using a large language model (LLM) agent to conduct post-compromise actions after obtaining initial access following the exploitation of a publicly-accessible Marimo network using a recently disclosed vulnerability. "The attacker compromised an internet-reachable Marimo notebook via CVE-2026-39987, extracted two cloud credentials from the compromised