Blahalla

Anthropic Releases New Claude Sandbox, Security Guidance Plugin

www.securityweek.com · a month ago

Anthropic added two security features to Claude: a self hosted sandbox in public beta and a security guidance plugin for Claude Code. The sandbox allows Claude Managed Agents to run in a user controlled environment connected to private MPC servers so tool execution occurs on the customer infrastructure or a managed provider while orchestration, context management, and error recovery remain on Anthropic infrastructure, and customer network policies, audit logging, and security tooling apply so files and repositories do not leave the perimeter. The security guidance plugin scans file edits, AI generated changes, and commits to detect risky code patterns and review full diffs, has been widely used internally, and its rollout reduced security related comments on pull requests by about thirty to forty percent.
Anthropic Launches Free Claude Code Terminal Plugin to Detect Security Vulnerabilities

gbhackers.com · a month ago

There is a free Claude Code terminal plugin from Anthropic named security guidance that continuously reviews AI generated edits in session to detect and remediate security vulnerabilities before they reach pull requests or CI pipelines. There are three review layers: a per edit deterministic pattern scanner that flags risky constructs such as dynamic code execution, unsafe deserialization, insecure DOM APIs and edits under sensitive workflow paths; an end of turn Claude diff review that targets higher level issues including authorization bypasses, insecure direct object references, injection vectors, server side request forgery and weak cryptography; and a commit time agentic review that reads surrounding context to validate findings and reduce false positives. The plugin runs locally in the Claude Code terminal, attaches automatically to coding sessions, focuses on AI generated edits while leaving human commits untouched unless routed through Claude Bash, and is extensible with repository guidance and custom pattern files while preserving built in rules. Model usage is consumed only for end of turn and commit reviews while the per edit scanner incurs no usage cost, and the tool is positioned as an early defense layer to complement rather than replace traditional application security controls.
Microsoft SharePoint Server Flaw Enables Remote Code Execution Attacks

gbhackers.com · a month ago

There is a critical vulnerability in Microsoft SharePoint Server that can allow attackers to execute arbitrary code remotely against on premises collaboration platforms. The flaw is tracked as CVE-2026-45659 and was first published on May 21, 2026 with an update on May 26, 2026 that added technical details. Organizations running on premises SharePoint Server are advised to apply Microsoft updates and follow vendor guidance immediately to mitigate remote code execution risks.
Microsoft Defender Gains Auto-Isolation Feature to Block Ransomware Spread

gbhackers.com · a month ago

Microsoft Defender XDR has introduced automatic attack disruption that autonomously isolates compromised assets in real time to contain ransomware and other sophisticated cyberattacks before they spread across enterprise networks. The system correlates signals from endpoints, identities, email collaboration tools and SaaS applications into unified high confidence incidents, identifies assets used for lateral movement, and executes automated response actions across Defender products to contain threats. It uses ensemble machine learning models and specialized small language models with Microsoft reporting 99 percent or higher confidence for automated containment, and deploys device isolation, IP address containment for unmanaged devices, granular port and communication blocks for critical assets, and user account suspension while allowing administrators to configure exclusions, review and reverse actions through an action center.
FBI Warns: ‘Kali365’ Phishing Service Targets Microsoft 365 Accounts

www.techrepublic.com · a month ago

There is a new phishing service named Kali365 that can hijack Microsoft 365 accounts by abusing Microsoft’s device code authentication flow to capture OAuth access and refresh tokens, with activity first observed in April 2026 by the FBI. The attack starts with a phishing email that provides a device code and directs victims to Microsoft’s legitimate verification page so they unknowingly authorize an attacker controlled device, enabling access to Outlook, Teams, OneDrive and other services without a password or additional multi factor authentication and allowing persistent access and single sign on abuse. To reduce exposure, organizations are advised to audit and where possible restrict or block device code flow with Conditional Access, block authentication transfer policies, limit exceptions for emergency accounts, review suspicious logins and preserve phishing evidence, and report incidents to the Internet Crime Complaint Center.
Microsoft previews automatic device isolation in Defender for Endpoint

www.csoonline.com · a month ago

There is a preview of automatic device isolation in Microsoft Defender for Endpoint’s automatic attack disruption feature that severs most network connections while keeping the device connected to security services to contain active cyberattacks. In testing by the SANS Institute, adversarial activity triggered high confidence detection thresholds that caused automated containment to disable all Active Directory identities in a simulated environment, including the local domain administrator, rendering the domain inaccessible. Researchers warn that threshold driven autonomous containment can produce large scale operational disruption unless governance controls, privilege aware safeguards, and system level constraints are implemented. Microsoft recommends keeping automatic attack disruption enabled by default while using granular controls such as device group tuning, selective exclusions, and reversible automated actions to halt lateral movement and preserve forensic evidence.
NASA picks Blue Origin to deliver lunar rovers to the moon

www.washingtonpost.com · a month ago

NASA has awarded Blue Origin a contract worth at least 188 million dollars to deliver the first lunar terrain vehicles to the Moon as part of its Moon Base effort to establish a sustained human presence at the lunar South Pole. NASA also contracted 219 million dollars to Astrolab and 220 million dollars to Lunar Outpost to develop those rovers, and awarded Firefly Aerospace 75 million dollars to build the lander that will carry NASA drones to survey landing sites in 2028. The Moon Base program, announced about six weeks after the Artemis II mission, plans robotic deliveries beginning this fall, aims to install a solar power grid and other infrastructure by 2029, and to construct semi permanent surface modules by 2032 to support a crewed lunar landing targeted for 2028 and annual surface missions thereafter.
At the A.I. Epicenter, Technologists Dismiss Pope Leo’s Warnings About the New Technology

www.nytimes.com · a month ago

Pope Leo XIV issued a sweeping encyclical titled Magnifica Humanitas calling for robust regulation of artificial intelligence and urging developers and governments to ensure AI serves the common good rather than concentrating power. The document warns that AI can become an instrument of domination, exclusion, and death, rejects transhumanist and posthumanist philosophies embraced by some in Silicon Valley, and stresses that AI lacks moral conscience and spiritual capacities so it must be governed by humane values. Leo presented the encyclical at the Vatican on May 25, 2026 after signing it on May 15, 2026, and Vatican events around the release included participation or engagement with Silicon Valley figures such as representatives from Anthropic. He urged the disarming of AI where it threatens human dignity and called for shared ethical codes and stronger oversight to prevent AI from worsening inequality, replacing workers, or enabling new forms of warfare.
From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities

www.microsoft.com · a month ago

A targeted cryptojacking campaign uses poisoned search results and AI chatbot responses to direct users to attacker controlled lookalike download sites that impersonate popular system utilities favored by PC and GPU enthusiasts. Downloads deliver ZIP archives containing a legitimate executable and a malicious autorun.dll that leverages DLL sideloading and msiexec to silently install a packaged ScreenConnect client, giving operators persistent remote access. Operators then deploy a SimpleRunPE dropper that installs as RuntimeHost.exe, establishes multiple scheduled tasks, registry Run keys, and a Startup shortcut for persistence, registers Defender exclusions, performs process hollowing into Microsoft signed.NET utilities to run GPU mining code, and includes anti analysis checks to evade detection. Microsoft Defender has detected and blocked activity linked to this campaign, and organizations are advised to enable cloud delivered protection, run endpoint detection and response in block mode, and enable attack surface reduction rules to reduce risk.
KnowledgeDeliver flaw exploited as a zero-day to install web shells

www.bleepingcomputer.com · a month ago

Hackers exploited a critical zero day vulnerability in the KnowledgeDeliver learning management system to deploy the Godzilla web shell. The flaw is a ViewState deserialization issue that stems from a shared hardcoded ASP.NET machine key across customer deployments and is tracked as CVE-2026-5426, allowing unauthenticated remote code execution by signing malicious ViewState payloads. Attackers used the key to sign payloads that installed a Cobalt Strike beacon and an in memory Godzilla web shell, modified application JavaScript to trick users into installing a fake security plugin, and escalated file system access on compromised servers.
Feeding Frenzy: 'Megalodon' Malware Infects Thousands of GitHub Repos

www.darkreading.com · a month ago

In a six hour campaign on May 18, 2026, Megalodon pushed 5,718 malicious commits to 5,561 GitHub repositories, injecting workflows that exfiltrated CI and CD secrets, cloud credentials, SSH keys, OpenID Connect tokens, and source code secrets to a command and control server. The threat uses two payloads: a primary that adds a malicious YAML file named SysDiag to create new workflows on pushes or pull requests and a secondary that replaces workflows with a workflow dispatch backdoor that remains dormant until activated via the GitHub API, enabling stealthy activation and data theft. Researchers reported roughly 3,500 repositories initially infected with numbers later estimated near 2,900, attribution to known groups remains unconfirmed, and organizations are urged to block connections to the malware command and control server, audit GitHub repositories and Actions workflows for malicious YAML files, and revoke and rotate any exposed credentials and keys.
Charter confirms data breach after ShinyHunters extortion threat

www.bleepingcomputer.com · a month ago

Charter Communications has confirmed a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom is paid. Charter said it is alerting authorities and that no sensitive personal information or customer proprietary network information was exfiltrated, while ShinyHunters claimed to have stolen 40 million records containing names, email addresses, physical addresses, phone numbers, phone type, plan information, some CPNI, and customer support ticket data. The threat actors said they gained access on April 1 through a voice phishing attack that compromised an employee Microsoft Entra account and used that access to export data from a Salesforce instance, reflecting the group’s broader campaign of compromising single sign on providers and stealing OAuth tokens to access connected SaaS applications.
State Cyber Leaders Push Congress for More Funding, Support

www.darkreading.com · a month ago

State cyber leaders warned that federal cutbacks have left states reeling from damaging attacks on critical infrastructure and urged Congress to restore funding and support for the Cybersecurity and Infrastructure Security Agency and for information sharing through the Multi-State Information Sharing and Analysis Center. Witnesses at a House Homeland Security Subcommittee hearing asked Congress to reauthorize and expand the State and Local Cybersecurity Grant Program, noted that MS-ISAC shifted to a subscription model and that CISA staffing and resources have been downsized, and said those changes have eroded trust with state and local officials. With federal help waning, states are turning to collaboration, training, state-run security operations centers, and free CISA municipal services where available to mitigate escalating threats accelerated by AI, supply chain compromises, identity exploitation, and increasingly aggressive ransomware extortion.
Shai-Hulud Hackers TeamPCP: Lucky or Skilled?

www.darkreading.com · a month ago

TeamPCP has wreaked significant damage on the open source ecosystem with the Shai-Hulud worm and follow-on campaigns, but researchers say the impact owes more to opportunism and operational effectiveness than elite technical sophistication. The group, active formally since late 2025 and linked to activity as far back as 2024, exploited weaknesses including React2Shell, misconfigured Docker APIs, and Next.js, using a self-replicating worm that poisoned npm components to propagate and push malicious updates. TeamPCP released Shai-Hulud source code, claimed a GitHub compromise via a poisoned editor extension that led to the theft of about four thousand private repositories, and relied on social engineering, trusted-platform abuse, AI-assisted reconnaissance, and weaponizing SLSA provenance to scale its attacks.
For Enterprises, Security Remains Agentic AI's Biggest Challenge

www.darkreading.com · a month ago

There is rapid enterprise adoption of agentic AI frameworks such as OpenClaw, which gained widespread popularity on GitHub and was highlighted by Nvidia, but the software has serious security and stability problems. Researchers reported at least 454 vulnerabilities in the framework in the National Vulnerability Database and Gartner advised blocking downloads and traffic for the platform because many exposed instances are insecure by default. Vendors and researchers are developing new agent focused architectures and governance tools, exemplified by NemoClaw and OpenShell, to provide sandboxing, policy enforcement, agent registration, and data protections because traditional security stacks are inadequate for autonomous agents.
SpaceX IPO Filing Reveals Favorable Terms for Elon Musk

www.nytimes.com · a month ago

There is a governance structure in SpaceX's IPO filings that would let Elon Musk retain near-total control through a dual class of super voting shares and controlled company exemptions. The proposed board lacks a majority of independent directors and is populated with long time allies tied to Musk's business network, limiting independent oversight. Pay and executive protections in the filing appear constructed to favor Musk, potentially blocking derivative claims and other shareholder remedies and drawing criticism from corporate governance experts and major public pension funds. Critics warn these choices would effectively eliminate meaningful investor input and entrench Musk's control even after the company lists.
Microsoft Issues Out-of-Band SharePoint Patch

www.darkreading.com · a month ago

Microsoft released an out of band patch for a remote code execution vulnerability in SharePoint Server tracked as CVE-2026-45659 and rated 8.8 on the CVSS scale. The flaw involves deserialization of untrusted data and could allow an authenticated attacker with as little as Site Member permissions to remotely execute code on the server without administrator privileges, with Microsoft noting low attack complexity and no required user interaction. No public exploit code or evidence of exploitation in the wild has been observed, the bug was reported by a researcher known as MEOW, and organizations are urged to apply the immediate patch quickly given SharePoint's value as an attacker target and history of similar exploit chains.
Navigating Lax Load Balancers: When an Intersection Gets You Inside

blog.doyensec.com · a month ago

AWS Elastic Load Balancers can serve as access control boundaries, but listener rule chains and target registrations can create unintended routing paths that expose backends. Common misconfigurations include direct ALB access that bypasses CloudFront and WAF, rule shadowing where a broad listener rule prevents restrictive authentication from firing, and alternate ALBs or listeners that defeat source IP restrictions. Auditors are advised to map the full routing graph, verify X Forwarded For header processing, walk listener rules in priority order, and test direct ALB reachability and all paths to gated targets rather than relying solely on static configuration checks. A read only CLI tool named ELBaph and a Terraform lab are available to automate mapping of load balancers listeners rules and targets, run targeted HTTP and HTTPS reachability probes, and generate structured findings with exploit paths and remediation.
FBI warns of Kali365 phishing kit that breaks into Microsoft 365 accounts – no password required

www.bitdefender.com · a month ago

There is a phishing as a service platform called Kali365 that can hijack Microsoft 365 accounts without stealing passwords by abusing device code flow and thereby bypassing multi factor authentication. Kali365, first spotted in April 2026 and promoted largely through Telegram, offers AI generated phishing lures, automated campaign templates, and the ability to capture OAuth tokens, with researchers documenting hundreds of attacks across North America and Europe. The FBI recommends blocking device code flow with conditional access policies in Microsoft Entra ID, excluding emergency access accounts to avoid lockouts, rolling out phishing resistant MFA such as hardware security keys, and reporting incidents to the Internet Crime Complaint Center.
‘Tiny11’ Gives Windows 10 Users a Risky Upgrade Path

www.techrepublic.com · a month ago

Tiny11 provides a stripped-down Windows 11 build that removes many preinstalled apps and services so older Windows 10 hardware that does not meet official Windows 11 requirements can run a lighter installation. Users can install a prebuilt Tiny11 ISO or create one by applying Tiny11 builder scripts to Microsoft's official Windows 11 ISO, and a valid Windows license is still required. Because Tiny11 is an unofficial, community-built project, users do not receive the same regular Microsoft updates or security protections, shifting maintenance and security responsibility to users and the image maintainer. Alternatives to avoid the security and support tradeoffs include Microsoft Extended Security Updates for Windows 10, lightweight Linux distributions, or ChromeOS Flex.
MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries

thehackernews.com · a month ago

An Iran-linked threat actor known as MuddyWater conducted an espionage campaign in the first quarter of 2026 that impacted at least nine organizations across nine countries on four continents, targeting industrial and electronics manufacturing, education and public sector bodies, financial services, and professional services, including a major South Korean electronics manufacturer and an international airport. The attackers used DLL side-loading of legitimately signed Fortemedia and SentinelOne binaries to execute malicious DLLs named fmapp.dll and sentinelagentcore.dll, embedded an open-source ChromElevator tool to siphon passwords, cookies, and payment card data bypassing App-Bound Encryption, and employed node.exe and Node.js scripts to deploy PowerShell for reconnaissance, SAM hive theft, screenshots, privilege escalation, and SOCKS5 tunneling. Data collection and exfiltration included a bespoke FileFiend tool, compressing files into RAR archives and uploading them to public web roots or public file-transfer services before tunneling them via proxychains and Axel, and researchers assessed the abuse of signed security binaries as a deliberate technique to evade signature-based detection and reflect tighter operational discipline.
Encrypted DNS in 2026: DoH, DoT, DoQ and DoH3 protocol comparison — including DNS hijacking attack vectors and what each protocol actually prevents

www.copahost.com · a month ago

DNS queries are sent in plain text by default, exposing which domains users visit to ISPs, local network observers, and attackers who can perform DNS hijacking. There are four major encrypted DNS transports: DNS over TLS runs on port eight hundred fifty three and is straightforward to detect and block, DNS over HTTPS runs inside standard HTTPS on port four hundred forty three and is the current browser default, DNS over QUIC uses QUIC with connection migration to make traffic correlation harder and improve resilience, and DoH3 runs DoH over HTTP three and offers similar QUIC performance benefits. Benchmarks across more than three thousand resolvers show DoQ and DoH3 have essentially closed the performance gap with unencrypted DNS, with DoQ delivering roughly thirty three percent better single query response time with session resumption, about two percent latency overhead versus UDP, and roughly ten percent faster page loads compared to DoH. Recommended actions are to use authoritative nameservers with global anycast, enable DNSSEC to protect against spoofing at the authoritative level, and recognize that visitors' resolver choice is largely controlled by browser and operating system defaults rather than individual website configuration.
OTP lockout state leaked valid-code signal, enabling OLX account takeover

minanagehsalalma.github.io · a month ago

A verification bug in OLX caused the OTP lockout state to leak correctness information by keeping the lockout banner while dropping the invalid-code signal for correct submissions. Because codes were four digits and remained valid for about seven minutes, an attacker could trigger the lockout, spray guesses, detect the one response that stopped showing the invalid marker, and recover the correct code. The response-difference flaw was reused across signup, login verification, password reset, and account recovery flows, enabling full account takeover through the same verification oracle. Persistent access was possible because password changes did not reliably revoke sessions, and the issue appears to have affected multiple regional OLX properties until the platform was reworked.
Identifying People Using Wi-Fi Routers

www.schneier.com · a month ago

There is evidence that standard WiFi routers can be used to identify individuals by analyzing WiFi signal behavior in a process called WiFi sensing. Researchers report using unencrypted beamforming feedback information and machine learning on recordings from nearly 200 participants to identify people by walking style, with reported accuracies of about 99.5 percent for the beamforming feedback method and 82.4 percent for an older channel state information method. The technique infers surroundings by observing how radio waves are reflected, scattered, and absorbed to effectively create images of people, and researchers warn this capability could turn routers into potential surveillance tools and are urging stronger privacy safeguards in the upcoming 802.11bf WiFi sensing standard.
GitHub Actions abused by Megalodon attack to slip malicious commits into 5,500 repos

www.csoonline.com · a month ago

A large automated campaign called Megalodon pushed 5,718 malicious commits into 5,561 public GitHub repositories within roughly six hours on May 18, 2026, modifying GitHub Actions workflows to include base64 encoded bash payloads that exfiltrate CI secrets. Attackers used compromised personal access tokens and deploy keys and forged author identities such as build-bot, auto-ci and ci-bot to push a malicious commit identified as acac5a9 without a pull request, affecting projects including Wiznet ioLibrary Driver, multiple Tiledesk repositories and persian tools, and researchers found that Tiledesk versions 2.18.6 through 2.18.12 carry the backdoor. Two payload variants, SysDiag and Optimize Build, either ran obfuscated bash on every push or used workflow dispatch to execute on demand, targeting AWS and GCP credentials, SSH keys, Kubernetes configurations, GitHub OpenID Connect tokens, source code secrets and other environment variables, and researchers advised monitoring for unexpected workflow dispatch runs and reviewing cloud audit logs for unknown token requests.
How Varonis Atlas integrates Claude Compliance API for AI governance

www.bleepingcomputer.com · a month ago

Varonis Atlas integrates the Claude Compliance API to ingest Claude Enterprise and Claude Platform activity into its AI security platform. This integration enables continuous monitoring of conversation content including chats uploaded files and projects, session level investigations to assess intent and misuse, and detection of sensitive data exposure jailbreak attempts and suspicious prompt patterns in real time. Atlas also surfaces audit and admin events from Claude Platform, provides real time alerts and proactive AI penetration testing to find prompt injection and jailbreak vulnerabilities, and connects AI activity to underlying data context such as permissions sensitivity classification and access so security teams can remediate exposures and enforce governance at scale.
AppOmni’s Marlin AI Brings Autonomous Investigation to SaaS Security

www.securityweek.com · a month ago

AppOmni has launched Marlin AI to automatically analyze SaaS misconfigurations, investigate related activity across enterprise environments, and recommend remediation steps while working alongside its AskOmni assistant. Marlin uses AppOmni’s accumulated SaaS context to prioritize risks by correlating risky configuration settings with observed behaviors and supplies investigative graphs for deeper analysis. It can automate corrective actions inside the AppOmni platform through user-confirmed operations but will not perform autonomous changes to third party SaaS systems because doing so would require elevated administrative access that customers are unwilling to grant.
How journalists rely on VPNs to protect press freedom

freedom.press · a month ago

There are three critical ways VPNs protect journalists: they mask a journalist's IP so sensitive online research cannot be traced to a newsroom or personal location. They prevent internet service providers and investigators from easily linking reporters to confidential sources by hiding visited websites and peer to peer connections, and they encrypt traffic on untrusted WiFi to reduce exposure to some cyberattacks. VPNs do not stop phishing or device compromise, so journalists should also keep devices updated and use two factor authentication and strong passwords, and lawmakers considering or enacting VPN bans risk weakening press freedom.
Iranian APT Targets Aviation, Software Companies With Updated Tools

www.securityweek.com · a month ago

Nimbus Manticore, an Iranian advanced persistent threat linked to Charming Kitten with suspected ties to the IRGC and active since at least 2022, has continued operations and expanded targeting to aviation and software companies including US organizations. The group adopted AppDomain hijacking by planting trojanized XML config files to load malicious DLLs and used phishing lures and trojanized installers to deploy updated backdoors such as MiniJunk and a new 64 bit MiniFast that impersonates Chrome and provides long term persistence, remote command execution, file exfiltration, process and directory manipulation, scheduled task creation, and payload deployment. Campaigns also abused search engine optimization and fake download sites and used fraudulent hiring portals impersonating airlines, and Check Point assesses Nimbus Manticore rapidly adapts and likely used LLM based and AI assisted techniques to develop tooling and maintain infrastructure.
CERT-In Mandates 12-Hour Patch Deadline for Internet-Facing Vulnerabilities

gbhackers.com · a month ago

India's national cybersecurity agency CERT-In requires organizations to contain and patch known exploited vulnerabilities affecting internet facing and crown jewel systems within 12 hours where feasible, citing AI driven attackers that are shortening exploitation timelines. The 38 page blueprint sets risk based deadlines including one day for critical externally exposed vulnerabilities and known exploited internal bugs unless strong compensating controls exist, three days for critical internal high value systems, and five days for other high severity issues, and it directs isolation, access tightening, WAF or API protections, and increased monitoring where vendor patches are not available. The guidance also calls for continuous exposure management across cloud, APIs, AI systems and third party dependencies, adoption of zero trust and assume breach principles, modernization of security operations with behavior based analytics and AI assisted defensive tooling, and reporting incidents to CERT-In within six hours.
Analyzing the Taiwan High-Speed Rail (THSR) TETRA incident (part 1)

www.midnightblue.nl · a month ago

On April 5, 2026 at 23:23 local time an unauthorized General Alarm transmitted over the Taiwan High Speed Rail TETRA network caused several trains to halt temporarily before services began restarting at 23:43 and disruptions ended by 00:11. Analysis indicates the operation was technically simple: passive SDR captures exposed network parameters, an Individual Short Subscriber Identity was cloned into a Motorola MTP3000 series handheld radio, an accomplice likely supplied critical parameters, and police later seized multiple radios and related equipment. The network was likely unauthenticated or using TEA1 encryption, the TEA1 backdoor enables trivial 32 bit brute forcing of keys, and related vulnerabilities cited include CVE-2022-24403, CVE-2022-24402, and CVE-2025-52944 which together weaken TETRA protections and permit traffic injection despite authentication.
Microsoft Defender can now automatically isolate hacked endpoints

www.bleepingcomputer.com · a month ago

There is a new Microsoft Defender for Endpoint capability available in preview that automatically isolates compromised endpoints to reduce attacker lateral movement and limit impacts such as data exfiltration and ransomware propagation. Automatically isolated devices are disconnected from the network but retain connectivity to the Defender for Endpoint service for continued monitoring, and the capability applies only to onboarded end user workstations managed by Defender for Endpoint. Security operators can release devices from isolation after investigation and mitigation by selecting the device in the device inventory or on the device page and choosing release from isolation.
Webinar: Too many tools are slowing network incident response

www.bleepingcomputer.com · a month ago

There will be a live webinar on June 2, 2026 featuring Edgar Ortiz of Tines that examines how shifting between monitoring dashboards, infrastructure tools, ticketing systems, and communication platforms slows network incident response. The presentation will explain how fragmented workflows force responders to manually collect context, determine ownership, prioritize incidents, and coordinate actions, which can increase response times and the risk of outages. Attendees will learn how automation, AI assisted and intelligent workflows that connect systems and automate repetitive operational tasks can enrich alerts with network identity and threat context, prioritize and route incidents automatically, and streamline investigations to improve operational coordination across complex environments.
Quasar RAT Hits Developers With Fileless Linux Attacks

gbhackers.com · a month ago

Quasar Linux, or QLNX, is a stealthy Linux remote access trojan that targets developer and DevOps workstations to create high value beachheads for software supply chain attacks. It launches as a single ELF binary but pivots to fileless, in memory execution using memfdcreate and execveat while unlinking the on disk binary and rewriting its comm and argv to mimic kernel threads to evade detection. QLNX dynamically compiles and deploys a two tier rootkit combining user space LDPRELOAD libraries, kernel eBPF programs, and malicious PAM modules, builds a peer to peer command and control mesh over TLS, and harvests SSH keys, personal access tokens, cloud credentials, and project level secrets from common developer paths. Detection requires correlating syscall telemetry, file integrity, authentication logs and network flows, watching for anonymous memfd executions, suspicious gcc compilations producing shared objects in temporary paths, modifications to the file /etc/ld.so.preload and hidden high entropy files, and confirmed compromises should prompt full operating system wipe and reinstall.
EU Regulators Prepare Landmark Fine Against Google Under Digital Markets Act

gbhackers.com · a month ago

European Union regulators are preparing a landmark penalty under the Digital Markets Act against Alphabet’s Google after accusing its search engine of systematically favoring Google services such as Google Shopping, Google Maps, and Google Flights in an investigation opened in March 2025. The enforcement could result in a fine reaching several hundred million euros and potentially up to ten percent of global annual turnover, with a final decision expected before the EU summer recess pending approval by the European Commission president. The case follows prior multibillion euro antitrust penalties and raises concerns about platform neutrality, data access, algorithmic transparency, and the effect of dominant platforms on the visibility of security and trusted sources.
Remembering Tim Wilson, Whose Legacy Lives on at Dark Reading

www.darkreading.com · a month ago

Tim Wilson, co-founder and former editor in chief of Dark Reading, died in late November 2021 after a brief battle with cancer. He co-founded Dark Reading in May 2006, led the site for about 15 years, and pioneered formats such as webinars, virtual events, research reports, and the INsecurity conference launched in 2017 to convene CISOs and security leaders. His mentorship and entrepreneurial vision are credited with shaping Dark Reading’s editorial direction and continue to influence the outlet as it marks its 20th anniversary and expands into video, podcasts, international coverage, AI tools, and Spanish language translation.
185,000 Likely Impacted by 7-Eleven Data Breach

www.securityweek.com · a month ago

There are roughly 185,300 likely victims of a 7-Eleven data breach that occurred on April 8 and involved systems containing franchise documents. The leaked dataset, which ShinyHunters initially claimed contained 600,000 Salesforce records and later published, contains names, addresses, email addresses, and dates of birth, with a small subset including additional fields. 7-Eleven said names and addresses were likely exposed and the incident fits a pattern of ShinyHunters targeting Salesforce instances via phishing, third party integrations, and misconfigurations.
[THN Webinar] New AI DDoS Attacks Are Smarter. Learn How to Fight Back

thehackernews.com · a month ago

There are AI assisted DDoS attacks that automatically find weak spots in systems and can launch massive attacks that take businesses offline in seconds. Traditional defenses like simple firewalls and routine patching are no longer sufficient because AI attacks adapt, probe APIs and cloud misconfigurations, and do in minutes what used to take humans weeks. A 45 minute webinar and companion checklist recommend shrinking the patch window to about 12 hours, avoiding common cloud configuration mistakes, deploying automated threat detection, and following a live blueprint to secure networks quickly.
Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions

thehackernews.com · a month ago

Microsoft has rolled out updates to fix a remote code execution vulnerability in Microsoft Office SharePoint. The flaw stems from deserialization of untrusted data and can be exploited by attackers without requiring any special conditions. The issue is tracked as CVE-2026-45659, scored 8.8 on the CVSS and rated important, and organizations are advised to apply the updates promptly.
Angular Language Service Extension Flaws Allow Remote Code Execution

gbhackers.com · a month ago

Multiple high severity vulnerabilities in the Angular Language Service VS Code extension Angular.ng-template enable remote code execution via malicious project files and dependencies. Attack paths include a JSDoc hover Markdown command injection that can execute command URIs from rendered tooltips and unsafe TypeScript SDK workspace handling that allows loading a malicious tsserverlibrary.js from workspace settings, both of which bypass VS Code Workspace Trust. The issues are tracked under GitHub advisory GHSA-ccq4-xmxr-8hcq, affect all versions before 21.2.4 and have been patched in the latest release. Developers are urged to upgrade to version 21.2.4 or later, review workspace settings, avoid opening untrusted repositories and packages, and enforce strict workspace trust policies.
Anthropic Expands Claude’s Enterprise Security Governance With 28 New Integrations

www.securityweek.com · a month ago

Claude now integrates with 28 security and compliance platforms, including CrowdStrike, Palo Alto Networks, Microsoft, Okta, Zscaler, Netskope, Cloudflare, Fortinet, Wiz, Datadog, SailPoint, Snyk, Tenable, and IBM. The integrations span data loss prevention, SASE, SIEM, identity management, e discovery, and AI observability and are powered by the Claude Compliance API which gives programmatic access to conversation content such as chats uploaded files and projects and to activity event logs including user logins admin actions and configuration changes. Organizations using the supported platforms can connect and configure a Claude instance so data flows into existing dashboards and alerting workflows and Anthropic has published documentation and a process for additional vendors to join.
TrapDoor malware campaign puts developer workstations in CISO spotlight

www.csoonline.com · a month ago

A cross registry malware campaign tracked as TrapDoor targets developer workflows and AI coding assistant files, spanning more than 34 malicious packages and over 384 related versions across npm, PyPI, and Crates.io. The packages are designed to steal developer secrets including AWS credentials, GitHub tokens, SSH keys, browser data, environment variables, crypto wallets, and local development configuration files, and to persist on workstations to enable lateral movement into CI and CD pipelines and build infrastructure. Attackers abused normal development execution points such as npm postinstall scripts, PyPI import time execution, and Rust build scripts, and attempted to alter AI assistant files like.cursorrules and CLAUDE.md using hidden Unicode instructions to trick AI tools into exposing secrets. Recommended mitigations include treating developer environments as production adjacent infrastructure, enforcing install time scanning for malicious packages and risky behaviors, using least privilege with short lived scoped credentials, package allowlisting, hardened developer endpoints, AI tooling governance, and zero trust controls.
Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment

www.securityweek.com · a month ago

Threat actors exploited a KnowledgeDeliver zero-day to deploy Godzilla web shells and backdoors against the KnowledgeDeliver learning management system used mainly in Japan. The flaw, tracked as CVE-2026-5426 with a CVSS score of 7.5, stemmed from hardcoded machineKey values in a standardized web.config file that enabled ViewState deserialization attacks and remote code execution. Attackers used the web shell to change web application permissions, inject malicious scripts, and ultimately install a Cobalt Strike backdoor with payloads tailored to specific victims, and Mandiant provided indicators of compromise and response guidance. All KnowledgeDeliver deployments before February 24, 2026, are potentially at risk, and organizations are advised to rotate machine keys, restrict LMS access, and monitor for signs of intrusion.
China-Linked Hackers Hit SEA Edge Routers With Custom Linux Implant

gbhackers.com · a month ago

China-linked hackers are conducting an infrastructure-centric espionage campaign across Southeast Asia by implanting Linux edge routers with a custom 64-bit ELF remote access trojan named router.elf, deploying a redundant backdoor called clientrcstart, and installing persistent iptables rules to control downstream traffic. The router implant uses DNS over HTTPS through a public DoH provider, protects C2 configuration with a custom Xorshift-based stream cipher and XOR obfuscation, and redirects internal DNS queries to attacker-controlled services on a nonstandard port using ipset and DNAT rules to enable man-in-the-middle name resolution. The same operator pairs this with a cracked Cobalt Strike 4.4 Beacon delivered to Windows hosts via DLL sideloading of version.dll under a crash reporting executable, using identical HTTPS polling and exfiltration endpoints and overlapping infrastructure to achieve unified command and control. Indicators include the filenames router.elf, clientrcstart and version.dll, plus multiple associated domains and file hashes, and the campaign is consistent with long-term espionage targeting telecom and government networks rather than short-term financial motives.
Open Source DockSec Uses AI to Cut Through Vulnerability Noise in Docker Images

www.securityweek.com · a month ago

DockSec correlates findings from multiple container security scanners, deduplicates and ranks vulnerabilities with a large language model, and generates plain English remediation guidance and exact Dockerfile fixes. Scans commonly surface large numbers of CVEs, with typical results exceeding two hundred CVEs and one example finding 183 high severity and 15 critical vulnerabilities across 15 images, and some images containing dozens of issues. The tool runs scanners locally and sends only scan metadata to the LLM, supports models from OpenAI Anthropic and Google Gemini or local models via Ollama, and has been adopted as an OWASP incubator project with growing community contributions.
Memcached SASL Flaw Exposes Usernames to Enumeration Attacks

gbhackers.com · a month ago

A timing side channel in Memcached SASL authentication allows remote attackers to enumerate valid usernames by measuring response time differences. The flaw is tracked as CVE-2026-47783 and affects Memcached versions before 1.6.42, caused by improper username validation that exits an internal loop early when a match is found. Developers fixed the issue in Memcached 1.6.42 by normalizing processing time during username validation and also addressed multiple memory corruption, crash, and protocol handling bugs. Organizations are urged to upgrade to version 1.6.42 immediately to mitigate username enumeration and related risks.
MFA Prompt Bombing: Why Your Second Factor Isn't Saving You

thehackernews.com · a month ago

Push based multi factor authentication is vulnerable to prompt bombing, where attackers with valid credentials repeatedly trigger approval prompts and often pair those prompts with vishing to wear down or trick users into approving access. A 2022 breach involving Cisco shows the method can succeed against mature defenses, as attackers harvested VPN credentials from a synced Google account, pushed prompts until an employee approved, enrolled attacker devices, escalated privileges, and exfiltrated about 2.8 gigabytes of data. Organizations can reduce risk by adopting phishing resistant factors such as FIDO2 security keys or number matching, blocking compromised passwords at the source, and enforcing conditional access that uses geography, device posture, and login time to stop suspicious logins before a prompt is sent.
Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register Entries

www.securityweek.com · a month ago

Lithuanian authorities are on high alert after a data leak of more than 600,000 entries from national registers that is believed to have been executed by a foreign country. The leak was primarily from real estate and legal entity registers and was carried out using login credentials of institutions authorized to access the data, prompting the resignation of the head of the State Enterprise Centre of Registers Adrijus Jusas. Authorities blocked suspected user accounts, required credential updates, and restricted access while the prosecutor’s office investigates suspected foreign involvement; no nation was specified, though officials noted Lithuania is a primary target of hybrid operations and an opposition politician suggested Russian intelligence may be responsible without providing evidence. Officials warned that addresses of intelligence officers, military personnel, diplomats and politicians may have been exposed, raising concerns about potential spying or pressure against those individuals.
NightSpire Ransomware Abuses RDP for Stealthy Persistence

gbhackers.com · a month ago

There are reports that NightSpire emerged in early 2025 and within a three month window from March to June 2025 compromised at least 64 organizations across 33 countries, with the United States the most affected. There are double extortion tactics that combine file encryption with data exfiltration and threats to publish stolen files on a Tor based leak site, and intrusions frequently begin with unauthorized Remote Desktop Protocol access. There are observations that operators maintain stealthy persistence by abusing legitimate remote administration tools such as Chrome Remote Desktop and AnyDesk installed as system services, using utilities like Everything and 7 Zip to locate and archive valuable files, and using MEGAsync to exfiltrate archives before encrypting data with a Go based encryptor that appends a.nspire extension and targets OneDrive synced files. There are recommendations that security teams test detections and response using breach and attack simulation platforms such as Picus with specific threat scenarios to evaluate defenses.
Admins of Bulletproof Hosting Service Used by Russian Hackers Arrested in Netherlands

www.securityweek.com · a month ago

On May 18, 2026, Dutch authorities arrested two men, a 57 year old from Amsterdam and a 39 year old from The Hague, suspected of owning companies that provided bulletproof hosting services to Russia aligned threat actors and evaded European Union sanctions. Investigators from the Dutch Fiscal Information and Investigation Service searched sites in Enschede and Almere and two data centers in Dronten and Schiphol Rijk, seizing laptops, phones and more than 800 servers. The operation allegedly served as a front to continue services for a sanctioned provider known as Stark Industries, which was placed on the EU sanctions list in May 2025, and local reporting identified the suspects as Youssef Z. and Andrey N. and linked the infrastructure to firms named Mirhosting and WorkTitans.