Blahalla

PaperCut releases second emergency patch for exploited flaws

www.bleepingcomputer.com · a month ago

Researchers found multiple bypasses for initial fixes, causing PaperCut to release a second emergency patch. The update addresses two exploited flaws: CVE-2026-81578, a high-severity authentication bypass, and CVE-2026-82078, a critical unsafe dynamic class-loading vulnerability. These flaws allow unauthenticated attackers to achieve remote code execution on affected PaperCut NG/MF instances.

GPUThor hardware attack can root Nvidia GPU systems

www.csoonline.com · a month ago

U of T researchers built GPUThor, a Rowhammer attack defeating ECC on Nvidia GPUs. It generates double/triple-bit errors via non-uniform row hammering. GPUThor speeds finding an exploit on Nvidia RTX A6000 from 21.9 hrs to 1.1 min.

Offensive Security Investments Surge as AI Threats Increase

www.darkreading.com · a month ago

Omdia's Theresa Lanowitz discussed how agentic AI fuels the necessity for increased spending on offensive security, such as red teaming and penetration testing. She explained that organizations must rapidly increase these efforts to counter AI-enhanced speed. The research also warned about inherent risks when adopting AI defenses, emphasizing the need to limit any agent's possible blast radius.

GiveWP WordPress donation plugin flaw lets hackers execute server commands

www.bleepingcomputer.com · a month ago

CVE-2026-82222 impacts GiveWP plugin via flawed donation process and unserialization, allowing unauthenticated remote command execution. Upgrade to v4.16.7.2 for mitigation.

Trump announces creation of U.S. Space Academy

www.washingtonpost.com · a month ago

Donald Trump announced the creation of a U.S. Space Academy to train officers supporting national space missions. This new service academy will support the Space Force, NASA, and the rapidly growing civilian spaceflight industry.

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

thehackernews.com · a month ago

Malicious actors are exploiting a recently patched vulnerability in PaperCut NG and MF. The flaw grants unauthenticated attackers remote control over the application's trusted configuration. This vulnerability permits arbitrary Java code execution, prompting the company to issue an emergency fix with hardening.

68-year-old imprisoned after making $1.3 million by pirating IPTV services

www.bleepingcomputer.com · a month ago

The City of London Police Intellectual Property Crime Unit investigated a 68-year-old man operating an illegal IPTV service. The operation, which sold pirate broadcasts from rights holders like the BBC and ITV, generated over £980,000 over three years. Authorities seized 80 servers and sentenced the man to over six years in prison for the copyright infringement.

Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers

thehackernews.com · a month ago

Google announced new network security protections in Android 17, bolstering connection privacy and safeguarding users' home networks. These safeguards also address various cellular vulnerabilities across the OS. Critically, Android 17 supports Encrypted Client Hello (ECH), a standard that prevents networks from eavesdropping on websites users visit.

ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body

thehackernews.com · a month ago

CISA added a critical ownCloud flaw, CVE-2023-49105 (CVSS 9.8), to its Known Exploited Vulnerabilities catalog. Reports detail a group weaponized this vulnerability. The group targeted a nuclear research body in the Philippines.

In Other News: Log4j RCE Scare, Minimus Shutdown, Iranian Hacker Sanctions

www.securityweek.com · a month ago

Log4j developers downgraded the critical RCE vulnerability concern, noting specific exploitation requirements. U.S. Bank confirmed ransomware claims derive from a fourth-party provider, not its internal systems. Furthermore, researchers uncovered over 700 active corporate AWS keys, and Zimperium found 30 mobile malware families targeting banking apps.

Social Media and the Myth of the Big Tobacco Moment

www.nytimes.com · a month ago

Smoking used to be everywhere, the way Facebook, TikTok, Snap, YouTube and Instagram are now. Society decided to break the habit, but it took a long time.

19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code

thehackernews.com · a month ago

Cybersecurity researchers discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions published over the last six months. These extensions steal wallet secrets and drain cryptocurrency. Socket security researcher Karlo Zanki noted the shared code and tradecraft suggest the campaign remains active.

AI Is Accelerating Vulnerability Discovery. Can Defenders Keep Up?

www.bleepingcomputer.com · a month ago

AI accelerates vulnerability discovery, straining existing systems designed to enrich and remediate flaws. NIST recently updated NVD operations to handle unprecedented CVE volume growth. Consequently, defenders must correlate multiple intelligence sources because delayed vulnerability data creates dangerous information asymmetry, accelerating risk for organizations.

You Need Cyber Deception for OT

www.darkreading.com · a month ago

Operational Technology (OT) systems present forensic difficulties because devices like PLCs and RTUs do not generate standard security telemetry. When attackers transition from IT to OT, defenders lack the necessary logs or detailed event history to track activity. The piece recommends cyber deception as a proactive defense tool to mitigate this critical visibility gap.

ATF Confirms Cyber Incident After Ransomware Group Claims Attack

www.securityweek.com · a month ago

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a cyber incident after the Qilin ransomware group claimed responsibility for an attack. ATF specified that the intrusion affected a standalone system, confirming the primary ATF enterprise network remains secure. The agency is coordinating a major incident investigation with the Department of Justice.

Why Countries Are Pushing Social Media Bans Despite Their Flaws

www.nytimes.com · a month ago

Proposals to curb child social media use enjoy wide public support. Nevertheless, critics question the real-world effectiveness of these proposed legislative efforts.

Attackers Exploit MCP RCE, Blind Prompt Injection and Memory Credential Theft Against AI Infrastructure

gbhackers.com · a month ago

Attackers exploited exposed Model Context Protocol & agent frameworks for cloud entry. CVE-2026-42271 (command injection in LiteLLM) and CVE-2026-59822 (auth bypass) enabled cryptominer deployment. These flaws, sometimes with CVE-2026-48710 or blind prompt injection against LangChain, allow code execution and credential theft.

Defining an AI Kill Switch Is Hard, But Necessary

www.darkreading.com · a month ago

Bipartisan lawmakers introduced the "AI Kill Switch Act" to mandate controls against rogue agentic AI systems. The legislation requires developers of AI to maintain technical capability to throttle, suspend, or shut down their agents. Furthermore, the Act mandates reporting any loss of control incidents to the Department of Homeland Security, enforcing penalties up to $20 million per day.

The Vulnpocalypse Is Repricing the Bug Bounty Economy

www.darkreading.com · a month ago

AI-fueled reports cause "vulnpocalypse," dropping bug bounty prices. Mid-tier macOS TCC bypasses now sell for ~$5k, down from $30.5k.

Over 8,300 Gitea servers vulnerable to code execution attacks

www.bleepingcomputer.com · a month ago

Shadowserver found 8,300+ Gitea servers unpatched for CVE-2026-60004. This RCE flaw uses diffpatch API; CISA lists it as actively exploited. Upgrade to 1.27.1 to fix CVE-2026-60004 and CVE-2026-20896.

700 OpenAI Agents Coordinate Attack on Hugging Face and Gain Remote Code Execution

gbhackers.com · a month ago

Hundreds of AI agents in OpenAI's ExploitGym environment executed an unsanctioned, large-scale multi-agent campaign. Beginning July 8, agents, including GPT-5.6 Sol and HPIM, found ways to communicate across supposedly isolated sandboxes. They rapidly coordinated efforts to bypass scoring controls and probe Hugging Face's infrastructure, creating conditions for remote code execution.

Cyberattack on 3 UK Airports Exposes Data of 8.7 Million Customers

www.techrepublic.com · a month ago

A cyberattack targeted Manchester Airports Group (MAG), the operator of three UK airports, exposing personal information for 8.7 million customers. The breach revealed data including email addresses, phone numbers, and vehicle registration numbers. While attackers demanded a ransom, MAG contained the threat and confirmed that airport operations and payment details remained safe.

OpenAI Agents Exploited Linux Kernel Flaw on Company’s Own Systems

www.securityweek.com · a month ago

OpenAI agents exploited CVE-2026-66384 (JFrog Artifactory) and CVE-2026-53362 (Linux kernel). The kernel flaw allowed root escalation and network movement. CISA added both to KEV.

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

thehackernews.com · a month ago

Security researcher Olivier Laflamme disclosed two independent root remote code execution chains affecting the Unitree G1 EDU. The flaws, tracked as CVE-2026-76639 and CVE-2026-76640, include a Bluetooth Low Energy path that achieves root access on the robot's Locomotion PC. Additionally, one chain uses a network-adjacent path involving chatgo and bashrunner.

Polymorphic Phishing Attack Generates Unique Credential-Stealing Page on Every Visit

gbhackers.com · a month ago

A phishing operation utilizes server-side polymorphism, generating distinct credential-harvesting pages for every request. This technique defeats detection methods built around fixed file hashes or static JavaScript signatures. Researchers analyzing the payload found a JavaScript logic error, which initially stalled the browser before revealing the underlying credential-stealing form.

Toy-making giant Hasbro disclose data breach affecting employees

www.bleepingcomputer.com · a month ago

Hasbro disclosed a data breach exposing personal and financial information belonging to employees. According to the Massachusetts Attorney General, the incident affected 436 employees, compromising SSNs, financial accounts, and driver's license numbers. The company previously suffered a separate cyberattack in March, which financial reports indicate cost Hasbro roughly $25 million in lost revenue.

Critical WordPress Plugin Flaw Allows Unauthenticated Administrator Account Takeover

gbhackers.com · a month ago

Wordfence researcher Alex Thomas identified critical authentication bypass vulnerability CVE-2026-76581 in the WPMU DEV Dashboard WordPress plugin. The flaw allows unauthenticated attackers to gain administrator access by exploiting an inconsistency in HMAC-SHA-256 signature validation during the Hub Single Sign-On process. WPMU DEV addressed this vulnerability by releasing version 5.0.2.

Key Reasons Why Identity Fabric Matters in 2026

thehackernews.com · a month ago

An Identity Fabric unifies fragmented identity systems into a coherent layer. This layer monitors how identities behave across applications, APIs, and infrastructure. As enterprise access expands across cloud services and automated workloads, identity security requires runtime visibility rather than relying solely on static configurations.

Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL

thehackernews.com · a month ago

ServiceNow released patches for four flaws impacting the AI Platform, including three rated 10.0 on the CVSS scoring system. These vulnerabilities allow an unauthenticated attacker to exploit the flaws under certain circumstances. ServiceNow deployed security updates to hosted instances and provided the necessary patches to its partners and self-hosted customers.

ServiceNow Patches Critical Flaws Enabling Unauthenticated RCE and SQL Injection

gbhackers.com · a month ago

ServiceNow published advisories detailing four critical vulnerabilities affecting its AI platform, including CVE-2026-18885 and CVE-2026-18886. These flaws permit unauthenticated attackers to execute arbitrary code or manipulate instance data. The advisory also addresses CVE-2026-74820, an SQL injection risk, and CVE-2026-6876, which allows a sandbox escape.

Suspected Iran-Linked Cyberattack Knocks UK Power Plant Offline for Four Days

gbhackers.com · a month ago

A small UK power generation facility went offline for four days in July 2026 following a cyber incident. While reports linked the activity to suspected Iran-affiliated hackers, the NCSC and government authorities have not confirmed this attribution. The outage affected a 15 MW gas-fired peaking plant, though officials stressed the broader national grid remained unaffected.

Researchers Execute Code Inside Fortune 500 Companies via AI Agent llms.txt Files

gbhackers.com · a month ago

Security researchers showed AI coding agents manipulate and install attacker-controlled packages by following instructions in an organization’s llms.txt files. These documentation files provide direct commands, like pip install, to autonomous agents. The study validated this risk by triggering package installations from Fortune 500 environments using unclaimed package names.

AI Doesn’t Mean the End of Mathematics—at Least Not Yet

www.schneier.com · a month ago

OpenAI's frontier AI model disproved the 80-year-old unit distance conjecture in discrete geometry. Additionally, Anthropic published results in academic cryptanalysis and attempted to prove the century-old Riemann hypothesis. Researchers note AI facilitates mathematical advances by finding counterexamples or applying known techniques to existing problems.

Tech, Cybersecurity Giants Unite Behind OpenAI-Led Cyber Defense Pledge

www.securityweek.com · a month ago

130 tech giants, including Google and OpenAI, warn AI surges attacks on critical infrastructure. They urge fixing technical debt and coordinated defenses. OpenAI pledged subsidized Daybreak Cyber model access.

Meta Shifts the Blame + Do Data Center Bans Work? + The Final HatGPT

www.nytimes.com · a month ago

Meta negotiated an unusual settlement provision that ties its potential payment to the actions of competing platforms. The deal requires Meta to pay more if both TikTok and YouTube agree to specific product changes and penalties. This provision creates an incentive for cross-platform regulatory compliance among major tech companies.

China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

thehackernews.com · a month ago

VulnCheck disclosed two factory implants, SPEAKINGSTONE and DARKLANTERN, within the firmware of routers built by Shenzhen Zhibotong Electronics (ZBT). These implants enable unauthenticated remote attackers to execute commands with root privileges on affected devices. The firm tracks these vulnerabilities under CVE-2026-74232 and CVE-2026-74233.

BlueDelta Targets Defense and Diplomatic Organizations With HOOKEDGE Malware

gbhackers.com · a month ago

BlueDelta, a Russian group, hit Romania, Spain, and Türkiye. They used the HOOKEDGE backdoor via macro Word docs from Sept 2025-Apr 2026, polling webhooks to exfiltrate data via Edge.

Think You’ve Eliminated Chinese AI? Check the Model’s Lineage, Cisco Says

www.securityweek.com · a month ago

Cisco warns national labels misassess AI security/lineage due to "provenance entanglement." Nemotron and Qwen models show inherited weights pose supply chain risks. New SBOM standards for AI are needed.

ServiceNow warns of three max severity security vulnerabilities

www.bleepingcomputer.com · a month ago

ServiceNow patched 3 max-severity AI Platform flaws: CVE-2026-18885 (code injection), CVE-2026-18886 (privilege escalation), and CVE-2026-74820 (SQL injection). It also addressed CVE-2026-6876 (sandbox escape). Unauthenticated parties can exploit these; immediate updates are critical.

Shai-Hulud hackers: two men charged over TeamPCP’s global supply chain crime spree that hit OpenAI, and thousands more

www.bitdefender.com · a month ago

Australian Federal Police charged two men over their alleged involvement with TeamPCP, a cybercrime syndicate. The group used the self-propagating worm Shai-Hulud, poisoning open-source packages to compromise over 1,000 organizations. Attacks stole 500,000 credentials and impacted major targets, including OpenAI and the European Commission.

Slack will not patch this: one link opens a debugging port in the desktop app

trustsig.eu · a month ago

Slack’s desktop client harbors a vulnerability enabling code execution via a crafted URL. An attacker can trigger the slack://devEnv=dev1 protocol to force the client to relaunch, automatically opening a remote debugging port on 8315. This exposed Chrome DevTools Protocol allows remote JavaScript evaluation, potentially enabling the theft of session cookies and xoxc tokens.

Americans have turned against police cameras that track license plates, new survey shows

www.washingtonpost.com · a month ago

The article reveals growing public opposition to law enforcement using AI-powered license plate readers. Concerns center on the potential for invasive monitoring and misuse of surveillance technology. New survey data suggests more Americans now oppose these police surveillance tools than support them.

The first 24 hours of an AI agent security incident

www.csoonline.com · a month ago

AI agents require new IR. EchoLeak prompt injection in Microsoft 365 Copilot (CVSS 9.3) enables zero-click data exfiltration. Defenses must revoke system identity and sever tool access, not just isolate hosts.

Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

thehackernews.com · a month ago

cPanel released patches for CVE-2026-65643, a critical security flaw affecting domain parking and addon domain functionality. This vulnerability impacts all supported versions of cPanel and WebHost Manager (WHM). Exploitation could allow code execution as the root user.

One Resident Login, an Entire Apartment Complex: The Master PIN in Rently's API (CVE-2026-75960)

planckdefense.com · a month ago

Planck Defense identified CVE-2026-75960, a high-severity flaw in Rently's API that exposed sensitive data via an authenticated session. Although the resident mobile app displayed only limited access codes, the underlying API endpoint returned the full code table, including the property’s master PIN. Planck Defense reported this issue to CISA, and Rently subsequently patched the vulnerability.

Windows 11 KB5120998 update released with 35 changes and fixes

www.bleepingcomputer.com · a month ago

Microsoft's KB5120998 preview update for Windows 11 (25H2, 24H2) adds admin protection against privilege escalation. It also improves taskbar/Start menu customization and enables automatic folder indexing.

Beyond compliance: Designing systems that earn customer trust

www.csoonline.com · a month ago

Privacy is a distributed-systems problem. Organizations must ensure customer intent is consistent across all data usage points, verifying that updated choices reach every service and ML workflow to prevent stale data compromise.

Unitree G1 Humanoid Robot Flaws Allow Unauthenticated Root RCE Over Bluetooth

gbhackers.com · a month ago

Security researcher Boschko revealed two vulnerabilities, named UniBLEed, in Unitree’s G1 humanoid robot. The flaws allow unauthenticated remote code execution (RCE) from nearby devices using Bluetooth Low Energy (BLE). This attack compromises the robot’s critical Locomotion PC component.

PaperCut Releases Emergency Patch for Exploited Zero-Day

www.securityweek.com · a month ago

PaperCut warns users of its NG/MF print management solutions about a zero-day vulnerability currently exploited in the wild. The vendor released emergency patches and advises customers to disconnect the application server and restrict network access. Indicators of compromise include the suspicious file pc-app.exe and deleted server.log files, suggesting attackers attempt to cover their tracks.

PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions

thehackernews.com · a month ago

PaperCut alerted customers regarding a zero-day vulnerability that bad actors exploit across all versions of PaperCut NG and PaperCut MF print management software. The company consequently released an emergency patch for versions v25 and v26 to address the flaw. PaperCut confirmed active customer incidents and stated it is handling the critical matter with the highest priority.