Blahalla

Lack of response to critical vulnerability in Gogs is a reminder of the limits of open source projects

www.csoonline.com · a month ago

A newly discovered and so far unpatched critical vulnerability in the open source Gogs Git service not only demands immediate action from developers to secure their code, it also puts a spotlight on the potential issues in using self-hosted code platforms from small maintainers. The hole is a critical argument injection vulnerability, discovered by a researcher at Rapid7, that allows any authenticated user to remotely execute code on a Gogs server by creating a pull request with a malicious branch name during a merge operation. Rapid7 published an analysis of the vulnerability today, after the maintainer of Gogs did not respond to a request for status updates or to an offer to defer disclosure after it first reported the hole over two months ago. “This is a serious vulnerability in software that isn’t commonly exposed to the public internet,” Ryan Emmons, staff security researcher at Rapid7, said in an email. “Gogs is typically used in an internal capacity; the most likely threat model is an attacker that has already gained access to an internal network environment exploiting the vulnerability to gain read/write access to source code repositories on the Gogs server. An attacker might leverage this access to silently tamper with source code and exfiltrate sensitive information, such as user password hashes and proprietary software.” Rapid defensive action required David Shipley, head of security awareness provider Beauceron Security, said both the Gogs maintainer and developers must take defensive action fast, because with the publication of a vulnerability “any attackers that didn’t know about this are going to be on it viciously.” The fact that it has been left unpatched for months as of Thursday afternoon is another reason why CSOs and developers prefer GitHub, he added. With any open source project, there are worries about if or when a patch will be issued. “The exploit requires no admin privileges and no interaction with other users,” Rapid7 said in its report. “An attacker operates entirely within their own account. Since Gogs ships with open registration enabled by default (DISABLEREGISTRATION = false) and no limit on repository creation (MAXCREATIONLIMIT = -1), an unauthenticated attacker can simply create an account and repository on any default-configured instance. Any registered user who creates a repo is automatically its owner. From there, enabling rebase merging is a single toggle in settings, and the entire exploit chain can be operated without interaction from any other user.” In addition, any user with write access to a repository where rebase is already enabled can exploit it directly. On instances where repository creation is restricted, an attacker still only needs write access to any repository that has (or can have) rebase merging enabled. If exploited, the vulnerability could not only lead to a Gogs server compromise, but from there it could turn into to a cross-tenant data breach, credential theft, lateral movement across an IT network, and software supply chain attacks through the code that is being developed on the compromised Gogs platform. Until a patch is released, developers and CSOs in organizations with the platform in use should strictly enforce restricted network access to Gogs, Emmons said, and ensure that only those who need access can use the application. Furthermore, if user self-registration is not already disabled, it should be. Only administrators should be able to create new user accounts. Rapid7 describes Gogs as a lightweight, self-hosted Git service written in Go that can run on any platform supported by the Go toolchain, including Linux, macOS, and Windows, as well as on ARM-based systems. It’s one of the more popular self-hosted alternatives to Microsoft-owned GitHub, says Rapid7, and is commonly deployed by companies, universities, and open-source projects. Other self-hosted Git services for developers include GitLab Community Edition, Gitea, Forgejo (a fork of Gitea), and Atlassian’s Bitbucket Data Center. Gogs pros and cons In a blog earlier this month, Open Source Alternatives, which describes itself as a curated directory of self-hosted tools that replace paid software, noted that developers may chose to self-host a git server to avoid GitHub outages, arguing, “your repositories stay online when GitHub goes down, your GitHub Actions minutes bill disappears and your source code never leaves your own server”. Emmons said Gogs is popular because it’s a lightweight and self-contained Git solution. It’s easy to deploy and run, he said, unlike many other Git servers that require heavy operational overhead and IT management. It’s also self-hosted on-prem software, which he said is ideal for teams that don’t, or cannot, for one reason or another, store source code in the cloud. The main pro, Emmons said, is that Gogs is an appealing solution from an operational simplicity perspective. It works well for what it does, and it doesn’t take much management effort to keep it working. But, he added, “a major con is what we saw with this disclosure; Gogs is open-source software maintained by kind people in their free time, and the developers behind it don’t have the support of a major corporate information security team. That means security issues can sometimes present in ways that they typically wouldn’t for a well-funded enterprise product.” This article

Anthropic confirms Claude Mythos-class models will roll out to the public

www.bleepingcomputer.com · a month ago

Anthropic has confirmed that it plans to bring Mythos-class models to the general public after delaying the rollout due to security risks to public and private software.

CVE-2026-0250 GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway (Severity: MEDIUM)

security.paloaltonetworks.com · a month ago

A buffer overflow vulnerability identified as CVE-2026-0250 exists in the Palo Alto Networks GlobalProtect app and is triggered during processing of requests and responses exchanged between Portal and Gateway. A man in the middle attacker could exploit the flaw to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges, and iOS builds are not affected. The issue is rated medium with a CVSS score of 5.2, no active exploitation is known, and users of affected Windows, macOS, Linux, Android, ChromeOS and UWP releases should upgrade to the vendor supplied patched versions such as 6.3.3-h9, 6.2.8-h10, 6.1.13, or 6.0.14 or later.

CVE-2026-0249 GlobalProtect App: Certificate Validation Bypass Vulnerabilities (Severity: MEDIUM)

security.paloaltonetworks.com · a month ago

There are certificate validation bypass vulnerabilities in the GlobalProtect App tracked as CVE-2026-0249 that can allow an attacker to intercept encrypted communications and potentially compromise the endpoint. A local non-administrative operating system user or an attacker on the same subnet could redirect traffic to an unauthorized server and facilitate installation of malicious software. macOS, Android and Chrome OS builds are affected in older releases with macOS exposure requiring SAML authentication using an embedded browser, while Windows, Linux, iOS and UWP builds are not affected. Users are advised to upgrade to the vendor provided patched versions for the affected clients as specified by Palo Alto Networks.

GreyVibe hackers use ChatGPT, Gemini to power cyberattacks

www.bleepingcomputer.com · a month ago

A likely Russian threat cluster tracked as GreyVibe has been targeting Ukrainian entities with AI-generated lures and a rich set of custom malware tools.

ShinyHunters Alleges 42M Records Stolen from Charter Communications

www.techrepublic.com · a month ago

Charter confirmed a cyber incident after ShinyHunters claimed it stole Spectrum customer data through vishing and SaaS account access.

BTMOB Android malware service generates custom phishing payloads

www.bleepingcomputer.com · a month ago

An Android remote access trojan named BTMOB is offered to cybercriminals with a builder interface for generating malware payloads tailored to phishing lures.

CVE-2026-0258 PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching (Severity: MEDIUM)

security.paloaltonetworks.com · a month ago

A server side request forgery vulnerability, CVE-2026-0258, in the IKEv2 implementation of PAN OS can allow an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or to trigger a denial of service. Multiple PAN OS releases in the 12.1, 11.2, 11.1 and 10.2 families are affected when a Site to Site VPN Gateway is configured with IKEv2; Panorama, Cloud NGFW and Prisma Access are not impacted, and fixed builds and upgrade guidance are available for each affected minor version. Mitigations include removing IKEv2 VPN gateway configurations if not required and enabling Threat Prevention by turning on Threat ID 510014, and the advisory was published May 13, 2026 with no known active exploitation.

CVE-2026-0259 WildFire WF-500 and WF-500-B: Arbitrary File Read and Delete Vulnerability in WildFire Appliance (WF-500, WF-500-B) (Severity: MEDIUM)

security.paloaltonetworks.com · a month ago

There is an arbitrary file read and delete vulnerability affecting Palo Alto Networks WildFire WF-500 and WF-500-B appliances running in the default non FIPS configuration, tracked as CVE-2026-0259 and published May 13, 2026. The flaw can be exploited over the network with low complexity and low privileges required, allows reading sensitive information and deleting arbitrary files, and is rated medium severity with CVSS 5.0 and a CVSS base metric of 7.1. A software update is available and customers are advised to upgrade to the fixed versions for their release lines or apply mitigations such as restricting access on air gapped deployments and enabling Threat ID 510010 with SSL decryption for Threat Prevention subscriptions.

CVE-2026-0265 PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled (Severity: HIGH)

security.paloaltonetworks.com · a month ago

An authentication bypass vulnerability identified as CVE-2026-0265 allows an unauthenticated attacker with network access to bypass authentication controls in PAN-OS when the Cloud Authentication Service is enabled, with the highest risk if CAS is enabled on the management interface. The issue affects PAN-OS on PA-Series and VM-Series firewalls and Panorama but does not impact Cloud NGFW or Prisma Access, and exposure requires an authentication profile using CAS attached to a login interface. Recommended actions include restricting management interface access to trusted IP addresses, temporarily disabling CAS or migrating to other authentication methods, upgrading to the fixed PAN-OS versions, and for customers with Threat Prevention enabling Threat ID 510008 as additional mitigation.

CVE-2026-0256 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (Severity: MEDIUM)

security.paloaltonetworks.com · a month ago

A stored cross site scripting vulnerability identified as CVE-2026-0256 in PAN-OS web interface enables a malicious authenticated administrator to store a JavaScript payload, affecting PA Series and VM Series firewalls and Panorama while Cloud NGFW and Prisma Access are not impacted. The issue is rated medium with a CVSS score of 4.4, is exploitable over the network with high privileges required, and Palo Alto Networks reports no known malicious exploitation as of May 13, 2026. Palo Alto Networks recommends upgrading to fixed PAN-OS versions or applying hotfixes and offers mitigations including enabling Threat ID 510020 with Threat Prevention, routing management traffic through a data plane port, replacing management certificates, decrypting inbound management traffic for inspection, and enabling threat prevention on inbound management services.

CVE-2026-0264 PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution (Severity: HIGH)

security.paloaltonetworks.com · a month ago

A heap based buffer overflow in the DNS proxy and DNS server features of PAN OS allows an unauthenticated attacker with network access to cause a denial of service on most PAN OS platforms and to potentially execute arbitrary code on PA Series hardware. The issue is tracked as CVE-2026-0264, is rated high with suggested urgency highest, and has remediation updates available with recommended upgrades to fixed PAN OS releases such as 12.1.7 or later and 11.2.12 or later. Until updates can be applied, customers can mitigate risk by disassociating DNS Proxy from externally accessible interfaces or disabling DNS Proxy, configuring DNS servers to use RFC1918 or trusted public IP addresses, and enabling Threat Prevention signature 510027 in content version 9100-10044 or later.

CVE-2026-0262 PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing (Severity: MEDIUM)

security.paloaltonetworks.com · a month ago

CVE-2026-0262 is a PAN-OS network traffic parsing vulnerability that allows an unauthenticated attacker with network access to cause a denial of service by sending specially crafted traffic. Panorama and Cloud NGFW are not impacted, and affected PAN-OS releases include multiple 12.1, 11.2, 11.1, and 10.2 builds for which fixed versions such as PAN-OS 12.1.7, 11.2.12, 11.1.15, and 10.2.18-h6 or equivalent updates have been published. Customers are advised to upgrade to the vendor fixed versions or mitigate HTTP exposure by enabling Threat Prevention IDs 510011, 510015, 510022 and 510023 with SSL decryption and appropriate Applications and Threats content updates. No malicious exploitation is known and the issue is rated medium severity with a CVSS score of 6.6.

CVE-2026-0263 PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing (Severity: HIGH)

security.paloaltonetworks.com · a month ago

A buffer overflow in IKEv2 processing of PAN-OS allows an unauthenticated network attacker to execute arbitrary code with elevated privileges or cause a denial of service, tracked as CVE-2026-0263. The vulnerability affects multiple PAN-OS 12.1, 11.2, and 11.1 releases prior to listed fixed versions, while Panorama, Cloud NGFW, and Prisma Access are not impacted. Customers are advised to upgrade to the fixed PAN-OS releases or mitigate exposure by configuring IKEv2 tunnels only with NIST approved Post Quantum Cryptography ciphers, and the issue is rated with urgency HIGHEST with no known exploitation at this time.

CVE-2026-0261 PAN-OS: Authenticated Admin Command Injection Vulnerability (Severity: MEDIUM)

security.paloaltonetworks.com · a month ago

There are multiple command injection vulnerabilities in PAN-OS that allow an authenticated administrator with access to the CLI or web user interface to bypass system restrictions and execute arbitrary commands as root, tracked as CVE-2026-0261. Affected products include PAN-OS on PA-Series and VM-Series firewalls and Panorama virtual and M-Series, while Cloud NGFW and Prisma Access are not impacted. The issue is rated Medium with a CVSS base score of 6.1 and suggested urgency Moderate, and the vendor recommends upgrading to fixed PAN-OS versions, restricting management interface access to trusted IP addresses, and enabling specified Threat Prevention signatures as mitigations.

The CISO Whisperer’s Watch List For The Gartner Security & Risk Management Summit 2026

gbhackers.com · a month ago

New York, USA, May 28th, 2026, CyberNewswire TVC Analyst Group has released its list of twelve cybersecurity companies identified for their activity and positioning ahead of the Gartner Security & Risk Management Summit 2026, where participating vendors are expected to present product updates, strategic initiatives, and technology developments. The annual Gartner Security & Risk Management

Anthropic Tops OpenAI to Become the World’s Most Valuable A.I. Start-Up

www.nytimes.com · a month ago

Anthropic raised $65 billion in new fund-raising that put its value at $900 billion, ahead of OpenAI’s last valuation of $730 billion, as the companies duel for A.I. dominance.

The Word 'Toad' Gave Any Website Full Control of Chrome's Most Popular VPN

amibeingpwned.com · a month ago

A vulnerability was discovered in the popular Urban VPN Chrome extension, allowing any website to send unauthorized commands without origin verification. The extension relied only on two static and publicly known strings for authentication, making it susceptible to exploitation. Attackers could use this flaw to disconnect the VPN, reroute traffic through foreign countries, or force users into data collection. The critical flaw, which received a CVSS score of 8.3, was resolved in version 5.12.5.

FBI warns of fake FIFA websites running World Cup fraud schemes

www.bleepingcomputer.com · a month ago

The FBI is warning of fake websites impersonating FIFA ahead of the 2026 World Cup, to steal personal and financial information, sell fake tickets and hospitality packages, and push other fraud related to the event.

Visual Studio Extensions Revisited

www.mdsec.co.uk · a month ago

Following concerns raised by compromised code extensions, security analysis is focused on Visual Studio. The report identifies two types of extensions: classic VSSDK extensions and modern VisualStudio.Extensibility components. Experts warn that the vulnerability risk from extension malware remains high.

Dutch Raid Fails to Dent Russian Bulletproof Host

www.darkreading.com · a month ago

Dutch law enforcement seized 800 servers and arrested two operators of THE.Hosting but left the hosting provider's core IP address space intact.

Russia-Linked ‘GreyVibe’ Attackers Use AI to Supercharge Cyberattacks

www.securityweek.com · a month ago

Researchers warn GreyVibe’s extensive use of ChatGPT, Gemini, and other AI tools offers a glimpse into how future cybercriminal and state-aligned groups will operate.

Hackers exploit FortiClient EMS flaw to push infostealer malware

www.bleepingcomputer.com · a month ago

Hackers are exploiting an authentication bypass vulnerability (CVE-2026-35616) in FortiClient Enterprise Management Server (EMS) to deliver an undocumented credential stealer called EKZ.

Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code

thehackernews.com · a month ago

A critical security vulnerability has been disclosed in Gogs, a popular open-source self-hosted Git service, that allows an authenticated user to execute arbitrary code under certain conditions. The security flaw, per Rapid7, is rated 9.4 on the CVSS scoring system. It does not have a CVE identifier. "The vulnerability allows any authenticated user to achieve remote code execution (RCE) on

Geordie Raises $30 Million for AI Security and Governance Platform

www.securityweek.com · a month ago

The funding round was led by Balderton Capital, with additional support from Crosspoint Capital and previous investors General Catalyst and Ten Eleven Ventures.

Threat Intel: Kemper Corporation Hit by ShinyHunters Salesforce Extortion Campaign (269k Accounts Ingested by HIBP)

www.technadu.com · a month ago

Kemper Corporation reportedly exposed approximately 270,000 accounts following an alleged breach by ShinyHunter. The compromise involved sensitive account details belonging to the company. Security experts recommend users change passwords and monitor for unauthorized activity immediately. No CVEs were mentioned regarding this incident.

FBI Warns Companies About Ransom Gang’s Fake IT Support Tactics

www.techrepublic.com · a month ago

The FBI warns Silent Ransom Group is targeting US law firms with phishing, fake IT calls, and in-person visits to steal data for extortion.

A.I. Is Making Scams Hard to Spot. Here’s How to Protect Yourself.

www.nytimes.com · a month ago

A criminal could be masquerading as a celebrity, web store or family member asking for your money. Detecting scams requires a new approach.

Apple May Bring Android-Style Theft Detection to iPhones

www.techrepublic.com · a month ago

Apple is reportedly testing an iPhone anti-snatching feature that would lock stolen devices using motion signals and checks for familiar locations.

Agentic AI Isn't Risky; the Way Orgs Deploy It Is

www.darkreading.com · a month ago

AI agents aren't black boxes, they're models interacting with software tools. The risk lies in their overlap.

Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer

thehackernews.com · a month ago

Threat actors are continuing to exploit a critical, now-patched security flaw impacting FortiClient Endpoint Management Server (EMS) deployments to deliver credential-stealing malware. "The campaign abused trusted endpoint management infrastructure to deliver malware across managed endpoints," Arctic Wolf said. "Threat actors disguised the credential stealer payload as a Fortinet endpoint

Google’s $135M Android Privacy Settlement: Who May Be Eligible

www.techrepublic.com · a month ago

Google’s $135 million Android settlement could pay eligible US users who used Android devices with cellular data since November 2017.

The Gentlemen ransomware: Dissecting a self-propagating Go encryptor

www.microsoft.com · a month ago

Microsoft Threat Intelligence presents a comprehensive analysis of The Gentlemen, a Go-based ransomware deployed by affiliates of Storm-2697 that combines per-file ephemeral key encryption with an aggressive self-propagation module to deploy itself across an entire network using series of simultaneous lateral movement techniques per target.

Drupal PostgreSQL SQL Injection: From SELECT-Only to RCE

blog.lexfo.fr · a month ago

A critical vulnerability chain has been identified in Drupal related to its interaction with PostgreSQL. Attackers can leverage SQL injection techniques to achieve full Remote Code Execution. Proper input sanitization and strict query validation are essential measures to prevent exploitation. Administrators must promptly apply available patches to mitigate this serious security risk.

Carnival Data Breach Exposed 6 Million People

www.securityweek.com · a month ago

Data breach leaves nearly 6 million Carnival customers navigating identity theft risks.

New Gogs zero-day flaw lets hackers get remote code execution

www.bleepingcomputer.com · a month ago

An unpatched zero-day vulnerability in the Gogs self-hosted Git service can allow attackers to gain remote code execution (RCE) on Internet-facing instances.

How SIEM helps MSPs reduce noise and stop threats faster

www.bleepingcomputer.com · a month ago

MSPs don't lack security data. They struggle to separate real threats from alert noise. Kaseya explains how SIEM helps MSPs improve visibility, reduce fatigue, and respond faster.

Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal

thehackernews.com · a month ago

Microsoft has come out strongly in favor of Coordinated Vulnerability Disclosure (CVD), urging the research community to share their findings and give affected vendors an opportunity to better understand the impact and address them before they are publicly disclosed. The development comes after a researcher named Chaotic Eclipse (aka Nightmare-Eclipse) disclosed details of multiple zero-day

MyPillow listed on ransomware gang’s leak site, but denies it has been breached

www.bitdefender.com · a month ago

A notorious ransomware gang claims to have stolen MyPillow's private data, but CEO Mike Lindell calls it a politically motivated "hit job." With the countdown ticking toward a massive dark web leak, who is telling the truth? Read more in my article on the Hot for Security blog.

Hackers Pivot from marimo RCE to Internal Database Using LLM Agent

gbhackers.com · a month ago

A newly observed intrusion demonstrates how attackers are replacing static playbooks with AI-driven agents that adapt in real time. The attack began on May 10, 2026, როდესაც threat actors exploited CVE-2026-39987, a remote code execution flaw in the marimo notebook environment. Once inside, the attacker harvested cloud credentials from environment files and system paths. Unlike

ThreatsDay Bulletin: Claude Security Plugin, Azure Priv-Esc, Kali365 MFA Bypass, FIFA Scams +15 More

thehackernews.com · a month ago

Every time you think the industry has finally stopped doing some reckless, low-effort crap, somebody spins up a fresh box full of sketchy loaders, fake installers, recycled social-engineering bait, and enough exposed infrastructure to make you wonder if prod is just a public beta now - meanwhile some researcher casually drops a technique that turns a "minor" foothold into total account

New BTMOB Android Malware Enables Full Device Takeover

www.securityweek.com · a month ago

Delivered via phishing lures, the malware combines financial theft with data exfiltration and remote access.

8 Best Enterprise Password Managers (2026)

www.techrepublic.com · a month ago

After reviewing the top enterprise password managers in the market, I found Keeper to be the best overall, particularly for its ease of use, and management-focused feature set.

Indian CERT urges firms to contain exploited internet-facing flaws within 12 hours

www.csoonline.com · a month ago

India’s cybersecurity agency, CERT-In, has urged organizations to patch, mitigate, or isolate known exploited vulnerabilities affecting internet-facing “crown jewel” systems within 12 hours where feasible, warning that AI-assisted attacks are dramatically compressing the time between vulnerability disclosure and exploitation. The recommendation, part of a sweeping new CERT-In blueprint on defending against AI-assisted cyber exploitation, signals a significant escalation in expectations around enterprise vulnerability management, exposure reduction, and operational resilience. The 38-page framework also recommends one-day remediation for critical externally exposed vulnerabilities, three days for critical internal vulnerabilities affecting high-value systems, and five days for high-severity flaws based on risk prioritization. CERT-In said threat actors are increasingly using AI to accelerate reconnaissance, vulnerability discovery, phishing, malware generation, and automated exploitation workflows. “Exploitation timelines are reducing significantly,” the agency warned in the advisory, adding that attacks are expected to become “increasingly autonomous.” An operationally disruptive target Security analysts said the headline 12-hour expectation is likely to force enterprises to rethink traditional weekly or monthly patching cycles, but cautioned that the guidance is more nuanced than a blanket patch mandate. “The 12-hour window is the outlier, realistic only as a containment target on a narrow set of exposed assets, never as a patch-completion target across sprawling estates burdened by fragmented infrastructure, layered approvals, outsourced operations, and legacy dependency,” said Sanchit Vir Gogia, chief analyst at Greyhound Research. Gogia said the blueprint’s tiered approach is more significant than the headline remediation clock itself because it ties response timelines to exposure and operational criticality rather than applying a uniform patching mandate across all systems. “The five-day high-severity window is comfortable for most enterprises. The three-day critical-internal window is where the pressure actually bites,” he said, particularly in sectors such as finance, telecom, healthcare, and operational technology environments where uptime concerns complicate rapid change management. Apeksha Kaushik, senior principal analyst at Gartner, said the biggest challenge for many organizations will not necessarily be deploying patches, but achieving the operational maturity needed for rapid exposure management. “The primary barriers are not just technical, but operational. Most organizations lack real-time asset visibility, automated vulnerability prioritization, and cross-functional incident response playbooks,” Kaushik said. “The most acute struggles will be in asset discovery, risk-based prioritization, and orchestrating rapid response across silos,” she added. From vulnerability management to exposure management The blueprint repeatedly emphasizes that traditional periodic security assessments are becoming insufficient against AI-enabled attacks capable of rapidly weaponizing newly disclosed flaws. Instead, CERT-In is pushing organizations toward continuous exposure management, threat-informed defense, continuous monitoring, and adversarial testing. Notably, the framework leans heavily on temporary mitigations, including isolation, access restrictions, WAF/API protections, enhanced monitoring, and compensating controls when immediate patching is not possible. Analysts said that approach makes the timelines more achievable operationally, but also shifts the burden onto asset visibility and exposure intelligence. “Compensating controls do make the timelines more workable. They also remove every excuse,” Gogia said. “If you cannot isolate, restrict, or monitor quickly, the problem was never patch cadence. The problem is that you do not know your own exposure.” Kaushik similarly said the guidance effectively pushes organizations toward more mature exposure management capabilities. “Organizations must be able to rapidly identify affected assets, assess risk, and deploy effective interim controls,” she said, adding that enterprises lacking mature asset inventories, segmentation, and monitoring capabilities will struggle to operationalize the guidance at scale. The blueprint also calls for continuous vulnerability assessments, AI-assisted security testing, adversarial simulations, penetration testing, and red teaming exercises. A preview of future global standards? Analysts said CERT-In’s remediation expectations are among the most aggressive currently issued by a national cyber agency and may influence broader international vulnerability-management practices as AI compresses attacker timelines globally. “CERT-In has done something the West has largely avoided: it has set standing clocks by asset category rather than deadlines by individual vulnerability,” Gogia said. He contrasted the framework with CISA’s Known Exploited Vulnerabilities (KEV) program, which typically uses vulnerability-specific remediation deadlines rather than persistent enterprise-wide remediation clocks. “The fixed-clock model looks aggressive today because the rest of the world has not caught up, not because it is reading the threat wrongly,” Gogia said. Kaushik said the framework could create operational challenges for multinationals whose global service-level agreements are less stringent than India’s expectations. “For providers, this may create a compliance gap where internal SLAs are less stringent than India’s requirements, necessitating a reassessment of global patching and mitigation processes,” she said.

Critical FortiClient EMS Vulnerability Exploited in Fresh Attacks

www.securityweek.com · a month ago

Fortinet rolled out hotfixes for the security defect in April, warning that it had been exploited in the wild as a zero-day and urging immediate patching.

Romanian gets 5 years in prison for hacking Oregon govt network

www.bleepingcomputer.com · a month ago

A Romanian national was sentenced this week to 56 months in federal prison for breaking into an Oregon state government computer network and fr cyberattacks targeting dozens of other U.S. victims.

IBM and Red Hat Commit $5 Billion to Secure Open Source Supply Chains Under “Project Lightwell”

www.securityweek.com · a month ago

Project Lightwell is designed to fix vulnerabilities without breaking what is already in production.

Focus on Cyber Insurance: How Quantifying Risk Is Reshaping Security

www.darkreading.com · a month ago

In this latest installment of the Reporters' Notebook video series, we discuss how cyber insurance is forcing organizations to quantify risk, what's covered (and what's not), and why this could be the best thing to happen to cybersecurity.

GlassWorm falls, but the repo problem is far from solved

www.csoonline.com · a month ago

Taking down a sprawling malware operation once signaled progress in securing the open-source ecosystem. Now, it barely registers. The GlassWorm campaign disruption comes at a moment when attackers can quickly reconstitute, and defenders are increasingly grappling with a new challenge: distinguishing real threats from automated noise. “I think coordinated actions, like GlassWorm, can sever control, significantly increase attacker costs, buy time for remediation, and signal the possibility of a fightback,” said Agnidipta Sarkar, chief evangelist at ColorTokens. “But most takedowns are temporary actions in a long fight.” The CrowdStrike-led takedown, conducted alongside Google and the Shadowserver Foundation, disrupted infrastructure linked to the campaign that had poisoned hundreds of repositories with malicious packages targeting developers. A day after the takedown, in an independent development, the OSV database withdrew 157 malware reports after maintainers determined the submissions were likely automated false positives. Takedowns help, but analysts question long-term impact The takedown happened on May 26, at 14:00 UTC, with CrowdStrike confirming the operation to have struck down “all four of GlassWorm’s command-and-control (C2) channels simultaneously”. This reportedly helped sever the botnet operators from their infected machines, blocking them from pushing out new malware. CrowdStrike described the GlassWorm operation as targeting infrastructure used to distribute malware through developer-focused repositories, an increasingly popular attack vector as adversaries chase CI/CD access, developer credentials, and downstream enterprise environments. GlassWorm was a cross-platform operation affecting Windows, macOS, and Linux systems, with trojanized VSCode extensions and compromised npm and Python packages for information and credential harvesting. “As part of our disruption efforts, we are working with partners to bring more pain to attackers, especially when we see them abusing our products or targeting our users,” said Google Threat Intelligence Group’s (GTIG) chief analyst, John Hultquist, in an X post. Still, the broader economics of repository abuse remain unchanged. Open-source ecosystems continue to offer attackers low-cost distribution, massive reach, and relatively weak identity verification compared to traditional software distribution channels. That means operators behind campaigns like GlassWorm can often reappear quickly under new accounts, domains, or package names. “It is disruption, not eradication,” Sarkar warned. “To build resilience after a takedown, defenders should prioritize rapid post-takedown scanning to detect the reemergence of malicious artifacts across related repositories and distribution platforms. ” They should then establish granular micro-perimeters, build capabilities to contain propagation across workloads, endpoints, IT/OT/IoT/cloud assets, and limit the blast radius of supply-chain compromises (e.g., a poisoned npm package or a GitHub workflow stealing creds can’t easily pivot). Sarkar advised developers and organizations to establish “granular micro-perimeters,” build capabilities to contain propagation across workloads, and limit the blast radius of supply-chain compromises. AI False positives are becoming part of the supply chain problem If GlassWorm highlights the persistence of real malware campaigns, the OSV withdrawal incident exposed a parallel issue affecting the open-source software (OSS) supply chain. It is the growing reliability surrounding automated security reporting. The withdrawal of 157 malware reports believed to be AI-generated false positives matters, especially when it includes packages like FastAPI v0.136.3. FastAPI is a heavily adopted Python framework powering production APIs, AI services, and cloud-native applications across industries. Even a few days of false flagging can trigger costly deployment delays, CI/CD disruptions, and hours of development time in isolating legitimate software. “I would recommend that enterprises be concerned enough about signal-to-noise problems to consider remedial measures, as automation erodes trust in defensive tools,” Sarkar said. “Unless you have a highly microsegmented enterprise, noise wastes analyst time, slows velocity, and risks missing sophisticated attacks amid fatigue.” In 2026, with AI-assisted malware and reporting both accelerating and rising false positives in SAST/SCA tools, defensive automation is getting asymmetrically compounded by supply-chain volume, he noted. In a blog post, Socket called bad OSV records particularly dangerous as the popular database gets rapidly carried through dependency scanners, CI checks, registry controls, SBOM tools, dashboards, and internal policy systems. All hope is not lost, though, as newer tools promise lower reliance on AI for hunting dependency vulnerabilities. CVE Lite CLI, a light-weight, JavaScript and TypeScript dependency vulnerability scanner, is offering developers a way to know dependency risks while they are still writing code, much earlier than failing automated scanners in CI pipelines.

Webinar: Why network incidents take too long to resolve

www.bleepingcomputer.com · a month ago

Many organizations can detect network issues quickly, but investigations and coordination often slow incident resolution. This webinar explores how automation and AI-assisted workflows can help IT teams reduce delays and improve response times.