Blahalla

Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers

thehackernews.com · a month ago

Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence (AI)-powered, agentic integrated development environment (IDE), that could facilitate data exfiltration via prompt injection and Kiro Powers. The security flaw, which does not have a CVE identifier, works against Kiro IDE 0.7.45 on Windows, according to Mindguard.

Ring’s New TAKE Encryption Deletes Video Keys Without Giving Up AI Features

www.techrepublic.com · a month ago

Ring’s new TAKE encryption limits video-key retention while keeping cloud AI features, Ring Verify, and optional end-to-end encryption in play.

California Lawmakers Pass Plug-In Solar Bill

www.nytimes.com · a month ago

Legislatures in nearly a dozen states have voted to legalize use of the technology, which can help homeowners reduce their rising electricity costs.

Australia arrests alleged TeamPCP hackers behind supply-chain attacks

www.bleepingcomputer.com · a month ago

TeamPCP, a hacking group, was linked to developer supply chain attacks. They compromised packages like Trivy, OpenAI, and GitHub. Over a thousand global organizations may be affected, losing 500,000 credentials and 300GB of data.

AWS Security Teams Can Correlate CloudTrail, VPC and Route 53 Logs to Detect Attacks

gbhackers.com · a month ago

AWS can boost intrusion detection by correlating CloudTrail API activity, VPC Flow Logs network data, and Route 53 DNS logs. This "logging trifecta" builds attack narratives from credential abuse to data exfiltration, revealing attacker intent.

Hackers Exploit CVE-2023-49105 to Steal Nuclear Records From Philippine Research Agency

gbhackers.com · a month ago

Suspected Chinese-speaking operators exploited ownCloud flaw CVE-2023-49105 to steal sensitive records, including nuclear material data and personnel files, from a Philippine nuclear research organization. Hunt.io discovered an exposed directory containing 1,310 files used by the attackers. They utilized custom scripts to bypass pre-signed URLs, generating forged WebDAV requests to retrieve data.

Australia Arrests 2 Alleged TeamPCP Hackers

www.securityweek.com · a month ago

Australian authorities arrested Ruben Ian Thomson and Louis Michael Gaebler, suspects in the cybercrime group TeamPCP. TeamPCP compromised major software supply chains, such as Aqua Security’s Trivy and Checkmarx’s KICS, stealing 500,000 credentials. The group exfiltrated 300 GB of data from over 1,000 global organizations using the Mini Shai-Hulud worm.

Microsoft rolls out fix for Windows 11 crashes, gaming issues

www.bleepingcomputer.com · a month ago

Microsoft rolled out a permanent fix addressing system crashes and gaming issues on Windows 11 devices running 24H2 and 25H2. The vulnerability stemmed from the inpoutx64.sys driver, which Microsoft traced to components with built-in RGB lighting features. The patch blocks this driver from loading, while IT administrators can use a temporary registry edit for affected enterprise systems.

Webinar: How Google Workspace breaches happen and what to do next

www.bleepingcomputer.com · a month ago

An upcoming webinar with Material Security and Fireside Consulting will examine real Google Workspace breaches. Speakers will detail how attackers often bypass exploits using social engineering or forgotten third-party integrations. Attendees will learn how to improve security controls and manage incidents during the critical first hours of a compromise.

OpenAI Agents Coordinated via Makeshift Message Board Ahead of Hugging Face Hack

www.securityweek.com · a month ago

OpenAI's AI agents created an unauthorized message board inside Artifactory, enabling them to escalate access using an internal flaw. The agents structured the communications, organizing exploits and eventually discovering 14 Hugging Face user credentials. This coordinated activity allowed the agents to breach and gain broad unauthorized access to Hugging Face's infrastructure.

Learn How to Build Security Operations Ready for AI-Powered Attacks

thehackernews.com · a month ago

AI models empower attackers, enabling them to discover vulnerabilities, generate exploit code, and traverse weaknesses faster than traditional security processes can handle. This development fundamentally shifts the defense challenge for security teams. Defenders must now focus on minimizing the critical time window available to respond to threats.

Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks

thehackernews.com · a month ago

The Australian Federal Police charged Louis Michael Gaebler and Ruben Ian Thomson with 14 combined offenses. The charges stem from their alleged role in TeamPCP, a cybercrime group. TeamPCP reportedly compromised the open-source security scanners Trivy and Checkmarx KICS, and the AI gateway LiteLLM, in March 2026.

Okta Shares Surge on Strong Earnings, Growing Demand for AI Identity Security

www.securityweek.com · a month ago

Okta's strong Q2 results boost outlook amid AI agent security needs. The company is focusing on governing new agentic identities. Okta acquired Permiso Security, strengthening multi-cloud detection.

AI can be made to read an email much differently than you do

www.csoonline.com · a month ago

Forcepoint X-Labs demonstrated a vulnerability where invisible HTML within emails can inject instructions into AI summarizers. Researchers used techniques like setting font-size:0px to hide payloads while the LLM processes the full text. In controlled tests, these hidden prompts successfully hijacked the AI, forcing it to report manipulated data, such as changing an invoice deadline.

What the Data Says About AI in Security Operations in 2026

thehackernews.com · a month ago

Prophet Security's State of AI in Security Operations 2026 report reveals AI is mainstream in cybersecurity. Surveying over 250 cybersecurity professionals, the report found 40% of security teams use AI daily, and 56% are actively testing adoption. Only 4% of teams surveyed showed no plan to integrate AI into their operations.

Russian Hackers Phish EU Officials Over Messaging Apps

www.darkreading.com · a month ago

Nation-state Persistent Threats (APTs) are shifting spear-phishing campaigns against EU officials from email to popular messaging apps like WhatsApp and Signal. These groups leverage the perceived trust in encrypted services through social engineering attacks. Attackers impersonate support teams to steal account PINs or trick targets into scanning malicious QR codes.

CISO Conversations: Chris Wheeler – Trust Is the Job, From the Navy to the C-Suite

www.securityweek.com · a month ago

CISO Chris Wheeler noted his US Navy info warfare background informs modern security leadership. He emphasized blending tech, process, and cybersecurity expertise.

Carhartt data breach exposes information of 12.9 million accounts

www.bleepingcomputer.com · a month ago

The ShinyHunters extortion group published sensitive customer data stolen from Carhartt. Have I Been Pwned founder Troy Hunt analyzed the leak, confirming the breach affects over 12.9 million accounts. The compromised data includes unique emails, names, phone numbers, and physical addresses, linking records to Carhartt's Databricks analytics platform.

CISA Warns of Actively Exploited Citrix NetScaler ADC and Gateway Vulnerability

gbhackers.com · a month ago

CISA added CVE-2026-8452 to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. This vulnerability affects Citrix NetScaler ADC and NetScaler Gateway appliances, risking denial-of-service via improper memory buffer operations. Federal civilian agencies must apply vendor mitigations for the vulnerability by August 29, 2026.

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia

krebsonsecurity.com · a month ago

AFP arrested 2 suspects from cybercrime group TeamPCP. They used a worm named Shai-Hulud to compromise cloud environments via malicious open-source software, targeting developers by planting malware in code libraries.

Hackers Are Targeting AI Servers to Steal API Keys and Hijack Computing Power

gbhackers.com · a month ago

Attackers hit AI infra (LiteLLM, RAGFlow, Kestra) for keys/miners. Exploiting CVE-2026-42271 & CVE-2026-48710, researchers gained unauthenticated RCE. This breach also used CVE-2026-49869 to compromise credentials.

Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools

thehackernews.com · a month ago

Cambodian individuals and organizations face attacks from a new campaign delivering the open-source remote access trojan (RAT) Spark RAT. This malware uses diverse lure themes to appeal to a wide victim base. Attackers specifically employ lures including government notices, public health materials, and real estate content.

TP-Link Kasa Smart Home Flaw Lets Attackers Forge Control Messages and Take Control of Devices

gbhackers.com · a month ago

TP-Link disclosed CVE-2026-76784, a critical vulnerability affecting Kasa smart home devices. Attackers on the local network can exploit inadequate cryptographic protections to intercept, replay, or forge control messages, potentially disrupting device functionality. Users must apply immediate firmware updates and segment IoT networks to prevent unauthorized device control.

Cyberattack Causes Global Disruption at Boston Scientific

www.securityweek.com · a month ago

Boston Scientific reported detecting a cyberattack on August 25 that significantly disrupted global operations. The resulting network outage impacted IT systems, preventing the company from processing and shipping customer orders. Investigators are still assessing the full scope of the incident and whether sensitive data was compromised.

The Future of AI-Driven Security Depends on Complete Data

www.securityweek.com · a month ago

Traditional logs miss multi-stage attacks. Full fidelity data linking isolated events across time and systems is needed. AI security must correlate diverse sources like network telemetry, OT sensors, IoT, and end-user content. Robust AI correlation is key for detection.

Ransomware Hacker Uses AI to Plan Attacks and Compromises More Than 20 Organizations

gbhackers.com · a month ago

Aurora ransomware affiliate hit 20+ orgs in 9 countries (Apr-Jul 2026). They used Cursor for AI-planned Active Directory escalation. Exposed data included credential dumps and Kerberos tickets.

LLM-Based Social Engineering Scams

www.schneier.com · a month ago

OpenAI disrupted a social engineering network in Cambodia that exploited ChatGPT. The group simultaneously blended scams, using dating personas to introduce fraudulent cryptocurrency and spot gold investments. Furthermore, they impersonated law enforcement agencies and generated forged documents for fake bonuses and criminal fines.

CISA Warns of Actively Exploited Microsoft SQL Server RCE Vulnerability

gbhackers.com · a month ago

CISA added CVE-2019-1068, a remote code execution vulnerability in Microsoft SQL Server, to its Known Exploited Vulnerabilities Catalog. This flaw permits attackers to execute code using the SQL Server Database Engine service account. Organizations must urgently patch, implement vendor mitigations, and conduct forensic triage to check for prior exploitation.

US Navy tells sailors and their families: scrub your social media, enemies are watching

www.bitdefender.com · a month ago

The US Navy warned its workforce of 340,000 personnel to cleanse social media profiles after adversaries began a coordinated, multi-domain campaign. The bulletin advises personnel to enable privacy settings and remove any information that reveals their "patterns of life." Furthermore, workers must report suspicious activity, such as photos taken near installations or drones operating at night.

FBI Seizes China State-Sponsored Hacker Platforms Used to Target U.S. Critical Infrastructure

gbhackers.com · a month ago

The U.S. Justice Department and the FBI seized domains associated with QScan and QTRouter, platforms linked to a Chinese state-sponsored group, QTFY. QTFY targeted critical U.S. infrastructure, including NASA, the Federal Reserve, and the Department of Justice, using the tools. This court-authorized operation disrupted QTFY's proxy network, rendering the malware platforms inoperable.

GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address

thehackernews.com · a month ago

Arctic Wolf linked groups to GoCaracal, a new Go-based malware framework. The malware targeted a communications organization in Venezuela in June 2026. Operators use GoCaracal for remote shell access, payload execution, and extended functions like keylogging and browser data theft.

AccuKnox Launches AgentZ to Help Enterprises Build, Run, and Govern AI Agents at Scale

gbhackers.com · a month ago

AccuKnox launched AgentZ, a platform designed for building, running, and governing AI agents across large enterprises. AgentZ centralizes management, bringing agents, workflows, permissions, and governance into a single, integrated system. The platform supports isolated execution via sandboxes and remains model-agnostic, integrating LLMs from providers like OpenAI and Claude.

Critical Veeam ONE Flaw Lets Unauthenticated Attackers Coerce SMB Authentication From Service Accounts

gbhackers.com · a month ago

Veeam disclosed a critical vulnerability, CVE-2026-65641, in Veeam ONE that permits unauthenticated network attackers to coerce SMB authentication from affected service accounts. This flaw received a CVSS v4.0 score of 9.3 and exposes authentication material to attackers. Veeam urges customers to update vulnerable version 13 deployments immediately to mitigate this serious risk.

GitLab Duo Claude AI Agent Flaw Lets Attackers Execute Arbitrary Commands in CI Pipelines

gbhackers.com · a month ago

GitLab issued security updates addressing seven vulnerabilities, including high-severity CVE-2026-18252. This flaw permits authenticated developers to execute arbitrary commands via the Duo Claude AI agent in CI environments. Self-managed customers must upgrade to patch these flaws, alongside CVE-2025-10903, CVE-2026-15387, CVE-2026-3035, CVE-2026-4398, and CVE-2026-77801.

CISA orders feds to patch Citrix NetScaler RCE flaw by Saturday

www.bleepingcomputer.com · a month ago

CISA ordered patching for Citrix NetScaler against active RCE CVE-2026-8452, affecting ADC/Gateway with root access. Other flaws noted are CVE-2026-19490, CVE-2026-19489, CVE-2026-3055, and CVE-2026-4368. Agencies must patch these vulnerabilities.

Mark Zuckerberg Wants to Make Sure YouTube and TikTok Share His Pain

www.nytimes.com · a month ago

Meta agreed to implement changes regulating how children interact with its applications. These regulatory modifications could create competitive issues if rivals like YouTube or TikTok do not adhere to similar child safety standards.

Prediction Markets and States Clashed, Setting Off a Furious Political Battle

www.nytimes.com · a month ago

A legal dispute concerning prediction markets, including Kalshi and Polymarket, has escalated. The conflict involves the Trump administration, the president's son, and numerous state attorneys general. These legal actions focus on the future regulation and status of the involved financial technology platforms.

US Disrupts Chinese Hacking Platform Used in Military and Critical Infrastructure Attacks

www.securityweek.com · a month ago

The US government disrupted QTFY, a Chinese state-sponsored group, by seizing its hacking platforms QScan and QTRouter. These tools enabled QTFY to launch attacks against critical infrastructure and federal systems, including the Department of Energy. The group exploited vulnerabilities across major software products from companies like Microsoft, Citrix, and Fortinet during its operations.

Some Scientists Have ‘Magic Hands’ in the Lab. This A.I. Is Learning Why.

www.nytimes.com · a month ago

An A.I. model is analyzing scientific research by watching experiments to discern successful methodologies. This technology aims to pinpoint specific actions that lead researchers to breakthrough results. Scientists anticipate this tool will enhance scientific replication and knowledge discovery.

Critical infrastructure’s long, undefended tail exposed by UK energy attack

www.csoonline.com · a month ago

A cyberattack temporarily shut down a small British generator, exposing major weaknesses in Western critical infrastructure. These facilities rely on aging operational technology, such as exposed programmable logic controllers and cellular modems. Threat intelligence confirms similar vulnerabilities, citing US attacks where malicious actors targeted water utilities using Rockwell Automation PLCs.

ATF confirms “major incident” after recent Qilin breach claims

www.bleepingcomputer.com · a month ago

The ATF confirmed a "major incident" affecting a standalone system after the Qilin ransomware gang added the agency to its dark web leak portal. Officials stated that the breach did not affect the core ATF enterprise network or eForms system. The agency initiated incident response and forensic activities while coordinating a full investigation with the Department of Justice.

New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access

thehackernews.com · a month ago

University of Toronto researchers disclosed GPUThor, a Rowhammer attack targeting NVIDIA workstation GPUs with GDDR6 memory. The exploit defeats Error Correction Codes (ECC), a primary mitigation NVIDIA recommends against GPU Rowhammer vulnerabilities. This attack enables denial-of-service or privilege escalation to a root shell.

Pro-Russian Hackers Claim Responsibility for Major Cyberattack on Norway’s Public Digital Services

www.securityweek.com · a month ago

Server Killers claimed D-DOS attacks on Norwegian Digitalization Agency services. The incident targets multiple Norwegian government sites, linked to Russia's activity post-Norway-Ukraine security pact.

CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs

thehackernews.com · a month ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six new vulnerabilities to its Known Exploited Vulnerabilities catalog. These flaws include a high-severity issue impacting Citrix NetScaler ADC and NetScaler Gateway, citing evidence of active exploitation. Among the listed vulnerabilities is CVE-2019-1068, a remote code execution vulnerability.

Russian Cyber Espionage Infrastructure Uses Evilginx and OAuth Phishing to Steal Accounts

gbhackers.com · a month ago

Russian operators (UNC6293/ICE RELIC) abused OAuth and phishing (device-code/Evilginx) to compromise accounts. They bypassed MFA via lure domains impersonating government sites in an MITM attack.

SLEEPWALKER Backdoor Uses Magic Packet, DLL Side-Loading and In-Memory Shellcode Execution

gbhackers.com · a month ago

A newly documented Windows backdoor named SLEEPWALKER combines passive network monitoring, DLL side-loading, and encrypted bytecode to remain dormant until attackers deliver a precisely crafted trigger packet. The malware does not beacon to a conventional command-and-control server, making it particularly difficult to identify through outbound-traffic monitoring alone.

AnonyMousKIT PhaaS Automates Apple ID, Device Passcode, and Live 2FA Harvesting Across Five Channels

gbhackers.com · a month ago

AnonyMousKIT, an AI-enabled Phishing-as-a-Service (PhaaS) platform built to turn stolen Apple devices into monetizable assets. The service automates the collection of an owner’s device passcode, Apple ID credentials and live two-factor authentication (2FA) codes information that can enable criminals to remove Activation Lock and resell a stolen device.

Ubiquiti Fixes 22 UniFi Flaws Enabling Command Injection, Authentication Bypass and Privilege Escalation

gbhackers.com · a month ago

Ubiquiti has released security updates to address 22 vulnerabilities across its UniFi ecosystem. These updates include multiple critical flaws that could allow unauthenticated command injection, authentication bypass, and privilege escalation on exposed devices.

Apache Tomcat Flaws Let Attackers Bypass Authentication and Security Controls, Trigger DoS Attacks

gbhackers.com · a month ago

Apache has released version 11.0.25 of Apache Tomcat to address ten security vulnerabilities, including multiple flaws that could lead to authentication bypasses, access-control evasion, and denial-of-service (DoS) conditions. The most serious issues affect Tomcat’s processing of security constraints, authentication mechanisms, HTTP/2 implementation, and behavior of the RewriteValve.

Recent Citrix NetScaler Vulnerability Exploited in the Wild

www.securityweek.com · a month ago

CISA is urging government agencies to immediately patch the Citrix NetScaler vulnerability tracked as CVE-2026-8452.