Blahalla

WhatsApp Chat Histories Exposed in Unencrypted Storage on macOS and iOS

gbhackers.com · 2 months ago

Security researchers have raised concerns over how WhatsApp stores user chat data on macOS and iOS, revealing that message databases may be stored in unencrypted form within app group containers accessible by other applications from the same developer ecosystem. According to researchers at Mysk, WhatsApp stores chat histories in plaintext within a shared app group
Telegram Channels Fuel Sale of Verified Bank Mule Accounts

gbhackers.com · 2 months ago

Cybercriminal groups are increasingly using Telegram channels and encrypted platforms to sell verified bank and fintech mule accounts, signaling a major shift in how illicit funds are laundered at scale. According to recent threat intelligence findings, money mule operations have evolved into structured Mule-as-a-Service (MaaS) ecosystems, allowing attackers to outsource financial laundering just as easily
Italian Authorities Dismantle CINEMAGOAL App Enabling Unauthorised Access to Streaming Platforms

gbhackers.com · 2 months ago

Italian law enforcement agencies have dismantled a sophisticated piracy operation centered around the CINEMAGOAL application, which enabled unauthorized access to premium streaming platforms including Netflix, Sky, DAZN, Disney+, and Spotify. The operation, codenamed “All Clear,” was led by the Financial Police in Ravenna under the direction of the Bologna Public Prosecutor’s Office. Authorities conducted over
Hackers Actively Scan SonicWall Firewall Interfaces as 597,000 Sessions Observed

gbhackers.com · 2 months ago

A sharp surge in internet scanning activity targeting SonicWall firewall management interfaces has raised concerns among cybersecurity researchers, with GreyNoise reporting nearly 597,000 sessions in a single day. The spike, observed on May 12, 2026, marks the highest volume recorded in the past 90 days and is approximately 46 times higher than the typical daily
DocketWise Data Breach Impacts 143,000

www.securityweek.com · 2 months ago

Hackers accessed names, addresses, Social Security numbers, financial information, and medical data from third-party partner repositories.
Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms

thehackernews.com · 2 months ago

Cybersecurity researchers have shed light on a cross-platform malware called RemotePE that has been put to use by the North Korea-linked Lazarus Group in attacks targeting financial and cryptocurrency organizations. RemotePE, per NCC Group subsidiary Fox-IT, is part of a multi-stage attack chain that involves two loaders tracked as DPAPILoader and RemotePELoader. "DPAPILoader decrypts and
CISA Warns Drupal Core SQL Injection Vulnerability Is Being Exploited in Attacks

gbhackers.com · 2 months ago

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical SQL injection vulnerability in Drupal Core, tracked as CVE-2026-9082, which is now being actively exploited in the wild. The flaw has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, signaling a high risk to organizations using affected Drupal deployments.
Hackers Exploit Azure RBAC to Steal Key Vault Secrets

gbhackers.com · 2 months ago

Hackers are increasingly exploiting cloud identity and access management systems, and a methodical, sophisticated, and multi-layered attack, where a threat actor we track as Storm-2949 launched a relentless campaign with a singular focus: to exfiltrate as much sensitive data from a target organization’s high-value assets as possible. The attack, attributed to a threat actor tracked
Hackers Exploit Shared CDNs to Evade Domain Reputation Filters

gbhackers.com · 2 months ago

Hackers are increasingly abusing shared Content Delivery Network (CDN) infrastructure to bypass domain-reputation-based security controls using a newly identified technique called “Underminr.” Underminr is not a conventional software flaw but an inherent weakness in how modern CDNs handle multi-tenant traffic. CDN providers such as Cloudflare, Akamai, AWS CloudFront, and Fastly route traffic for millions of
Over 5,500 GitHub Repositories Infected in ‘Megalodon’ Supply Chain Attack

www.securityweek.com · 2 months ago

Fake automated commits injected GitHub Actions workflows containing payloads to steal credentials, CI secrets, keys, and tokens.
Hackers Hide Linux Malware in SSH-Like Package Filename

gbhackers.com · 2 months ago

Hackers have been observed disguising a malicious Linux payload under an SSH-like filename during software installation, as part of a coordinated supply chain attack targeting developer ecosystems. The attack hinges on a hidden post-install script embedded inside package.json, rather than the expected composer.json used in PHP environments. This subtle placement allows the malicious code to evade detection during routine dependency
To pay, or not to pay: 58% of CISOs say they would pay the ransom for their data

www.csoonline.com · 2 months ago

If you were hit by ransomware tomorrow, would you pay to get your data back? That’s what more than half of CISOs in a recent survey said their organization would do. It’s a situation more companies are going to face in future. “Attacks are increasing and continuing to increase,” said Christy Wyatt, CEO of security vendor Absolute Software, which commissioned the survey. “Companies are better prepared to deal with them: Some of the training is paying off and AI is helping. But remember that attackers have all the tools that defenders have.” In the survey of 750 CISOs in the US and UK, 58% said their organization would be willing to pay to end a ransomware incident. This flies in the face of advice from the authorities in both countries. “It is the UK government’s long-standing position, alongside law enforcement partners, that it does not encourage, endorse nor condone the payment of ransom demands,” said a spokeswoman for the UK National Cyber Security Centre. The FBI, too, warns not to give in to ransomware demands, noting that paying only encourages the perpetrators to attack others. Another reasons law enforcers advise enterprises not to pay is that there is no guarantee they will get their data back if they do. Given the risks, and the disapproval of law enforcement, how many of those CISOs who say they are willing to pay would do so if it came to the crunch? It’s hard to get firm statistics because of the perceived stigma, but the evidence suggests a significant number do so. Among those companies hit by ransomware, 37% paid the ransom, according to an IDC survey last year, but IDC research director for security services David Clemente suspects the proportion is higher. “I’m sure that there are many more who have paid it but don’t want to be open about it,” he said. That wasn’t the end of things for all who paid the ransom, though: about 5% of them found that “the decryption was incomplete,” according to IDC. A late 2025 survey from insurance provider Hiscox found that only 60% of SMEs that paid a ransom successfully recovered all or part of their data as a result. Absolute’s Wyatt warned, “You may get your data back, you may not.” And if you do get your data back, that doesn’t mean you’re the only one who has it: “We have heard instances of companies paying up and finding that their credentials are being shared,” she said. So, does that mean enterprises shouldn’t pay the ransom? IDC looked at that and found that companies that had planned for such attacks would be able to resist, but with ill effects. About 29 percent of companies were able to recover encrypted files from backup,” said Clemente. “However, 33% of companies that didn’t pay, found that they could not recover anything.” UK retailer M&S didn’t pay up when it was hit by ransomware in April 2025, disrupting internal logistics systems and forcing it to close its online store for months. It estimated the cost of the incident at $400 million in lost operating profit. The ransomware payment dilemma remains an issue for CISOs, but the lesson M&S may point to is that, if a ransomware attack happens, your best bet may be to pay the ransom unless you have confidence in the quality and robustness of your backup. Government and law enforcement may not like it, but they won’t be the ones facing the wrath of shareholders.
GitHub Strengthens npm Security With Staged Publishing Protection

gbhackers.com · 2 months ago

Staged publishing is now generally available in npm CLI version 11.15.0, queuing prebuilt package tarballs for manual maintainer approval before release and protecting approval actions with two factor authentication to reduce supply chain risks from compromised accounts, malicious updates, and automated CI CD workflows. The staging queue is visible through both the npm command line and the npm website interface, and combining staged publishing with trusted OpenID Connect publishing lets CI CD pipelines be restricted to stage only while maintainers approve releases from trusted devices. npm 11.15.0 also adds install time flags that support all or none settings to control dependency sources such as local files, remote URLs, local directories, and Git based dependencies via.npmrc or package.json, and the default for Git based installs is expected to change to none in npm CLI version 12.
Iranian APT Uses SEO Poisoning to Spread Fake SQL Developer Malware

gbhackers.com · 2 months ago

A newly observed campaign linked to the IRGC affiliated threat group Nimbus Manticore, also tracked as UNC1549, has adopted SEO poisoning to publish a fake Oracle SQL Developer download site and distribute a trojanized installer. The installer delivers a new 64 bit backdoor called MiniFast that replaces earlier MiniJunk variants and provides full remote control including file exfiltration, command execution, process manipulation, and persistence via scheduled tasks. MiniFast communicates with command and control servers using structured HTTP and JSON exchanges that mimic browser traffic, uses Base64 encoded tasking and opcode based commands, and the campaign shows AI assisted development traits and stealth techniques such as using legitimate signed binaries, AppDomain hijacking, string obfuscation, and sandbox evasion. Targets include aviation, defense, and telecommunications across the United States, Europe, and the Middle East, and the shift from phishing to search engine driven delivery marks a rapid evolution in tactics tied to Operation Epic Fury that began on February 28, 2026.
TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO

thehackernews.com · 2 months ago

A new coordinated cross-ecosystem software supply chain attack campaign has targeted npm, PyPI, and Crates.io to distribute credential-stealing malware. The campaign, codenamed TrapDoor, spans more than 34 malicious packages across over 384 versions. The earliest activity was recorded on May 22, 2026, at 8:20 p.m. UTC, with new packages published to the ecosystems in waves from a cluster of
Kazuar Malware Becomes Modular Spyware for Secret Blizzard Ops

gbhackers.com · 2 months ago

There is a major evolution in the Kazuar malware family linked to the Russian state sponsored group Secret Blizzard also known as Turla and Venomous Bear, with a new modular architecture composed of Kernel Bridge and Worker modules to support long term espionage against government diplomatic and defense targets. The Kernel coordinates tasks communications and configuration and includes anti analysis checks while the malware exposes roughly 150 configuration options enabling AMSI WLDP and ETW bypasses as well as keylogging screenshot capture file harvesting and MAPI based email monitoring. Internal coordination relies on IPC mechanisms such as named pipes Mailslots and hidden Windows messaging while external command and control uses HTTP WebSockets and Exchange Web Services with a leadership election that selects a single node to communicate externally through a Bridge proxy to minimize network noise. Deployment methods include the Pelmeni dropper embedding encrypted payloads and a NET based COM loader for in memory execution, collected data is stored encrypted in a dedicated filesystem and routed internally using Google Protocol Buffers, and defenders are advised to focus on behavioral detection of IPC activity leadership election patterns staged filesystem operations and low frequency encrypted communications.
Hackers Compromise 34 npm, PyPI, and Crates Packages in Major Supply Chain Attack

gbhackers.com · 2 months ago

There is a large scale cross ecosystem software supply chain attack tracked as TrapDoor that began on May 22, 2026 and compromised at least 34 open source packages and more than 384 malicious versions across npm PyPI and Crates io, starting with a PyPI package named eth-security-auditor. The malware is a crypto focused credential stealer that deploys a shared payload called trap core js and executes via npm post install scripts, PyPI remote JavaScript on import, and Rust build rs at compile time, harvesting SSH keys, cloud credentials including AWS access keys and GitHub tokens, crypto wallet data for Solana Sui and Aptos, browser stored login data, and environment variables. Attackers established persistence using Git hooks, shell configuration files, cron jobs, and systemd services, attempted lateral movement with stolen SSH credentials, and abused AI developer tools by injecting hidden instructions into files such as dot cursorrules and CLAUDE dot md using invisible Unicode characters to trick AI assistants. Developers are advised to audit dependencies before installation, use tools that detect malicious package behavior, monitor for unusual post install or build time activity, restrict access to sensitive credentials, and rotate keys regularly.
MiniUpdate RAT Abuses Azure C2 for Targeted Espionage

gbhackers.com · 2 months ago

A sophisticated espionage campaign by the Iran-linked advanced persistent threat group Screening Serpens, also tracked as UNC1549 and Smoke Sandstorm, deployed a newly identified remote access Trojan family called MiniUpdate against targets in the United States, Israel, and the United Arab Emirates. MiniUpdate and an evolved MiniJunk V2 share an infection chain that uses targeted spear-phishing, archive lures, DLL sideloading, and Azure-hosted command and control infrastructure, and MiniUpdate leverages AppDomainManager hijacking to manipulate.NET application configuration files and disable runtime security before executing its payload. Unit 42 identified six variants uploaded between mid-February and April 2026, noted extensive opsec techniques including scheduled persistence and a broad opcode set for command execution and exfiltration, and urged defenders to tune endpoint detection to flag DLL sideloading and AppDomainManager hijacking while monitoring for clusters of Azure-hosted subdomains impersonating sector-relevant organizations.
Nginx-poolslip Flaw Exposes Servers to DoS and Code Execution Attacks

gbhackers.com · 2 months ago

There is a critical vulnerability tracked as CVE-2026-9256 in the ngxhttprewritemodule of NGINX that can be triggered by specially crafted HTTP requests to cause a heap based buffer overflow, resulting in denial of service and, under certain conditions, remote code execution. The flaw is caused by improper handling of overlapping unnamed PCRE capture groups in rewrite directives, where ambiguous regular expression patterns and multiple backreferences can produce out of bounds writes. Affected releases include NGINX Open Source up to 1.30.1 and NGINX Plus 37.0.0 with fixes in Open Source 1.30.2 and 1.31.1 and Plus 37.0.1.1, and recommended mitigations are to upgrade immediately, audit rewrite rules to replace unnamed captures with named captures, and enable exploit mitigations such as ASLR.
Hackers Use CypherLoc Kit to Push Fake Microsoft Support Scams

gbhackers.com · 2 months ago

CypherLoc is a sophisticated browser-lock scareware that executes an encrypted, condition-gated payload inside compromised web pages to evade scanners and sandboxes and coerce victims into calling fraudulent technical support numbers. It uses runtime page replacement, developer tools disruption, aggressive full-screen locking, audio pressure, fake login forms, and public IP display to heighten fear, prevent live analysis, and keep victims engaged. Barracuda researchers observed about 2.8 million attacks since the start of 2026 and defenders are advised to prioritize anti-phishing, browser and endpoint protections, and user education because legitimate security alerts do not lock browsers or display phone numbers.
nmap on Linux: Guide to Network Scanning and Discovery

linuxblog.io · 2 months ago

There are instructions for using Nmap on Linux to perform host discovery, port and UDP scanning, service and version detection, operating system fingerprinting, and running Nmap Scripting Engine scripts for enumeration and vulnerability checks. Common commands and options shown include -sn for host discovery, -sS for SYN scans, -sU for UDP scans, -sV for version detection, -O for OS detection, -A for an aggressive combined scan, and --script with categories such as vuln or ftp-anon for targeted checks. The guide also explains output formats including normal, XML, and grepable files, timing templates from T0 to T5, ways to scan ranges or lists of hosts, and cautions to only scan systems you own or have explicit permission to test and to use conservative timing on production networks.
Prompt Injection finally broke my brain a little. My first article as a security student.

www.cmxchat.com · 2 months ago

Prompt injection is a class of attack that lets malicious language in system prompts, retrieved documents, emails, and files manipulate a large language model's reasoning and override intended instructions. There are direct attacks that inject commands into conversations and indirect attacks that poison retrieval pipelines or documents, with real world 2025 to 2026 enterprise examples showing data leakage, moderation bypasses, and tool hijacking when agents and retrieval augmented generation systems pull in poisoned content. Defenses are layered and include separating core system instructions from outside data, sanitizing or filtering retrieved content, applying least privilege to tools, monitoring outputs closely, running regular red and purple team tests, and requiring human approval for high risk actions.
Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

www.bleepingcomputer.com · 2 months ago

A large-scale campaign is exploiting a critical SQL injection vulnerability CVE-2026-26980 in Ghost CMS to steal admin API keys and inject malicious JavaScript that triggers ClickFix social engineering flows. Researchers at XLab confirmed the campaign impacted more than 700 domains, including university portals, AI and SaaS companies, media outlets, fintech firms, security sites, and personal blogs. The attack chain abuses the vulnerability to read database data and obtain admin API keys, then injects a lightweight loader that fetches cloaked second-stage scripts which display a fake Cloudflare prompt instructing victims to paste a command that drops payloads observed as DLL loaders, JavaScript droppers, and an Electron sample named UtilifySetup.exe. Administrators are urged to upgrade Ghost to version 6.19.1 or later, rotate any exposed keys, remove injected scripts using provided indicators of compromise, and retain at least 30 days of admin API logs for retrospective investigation.
How to Use Claude AI: A Complete Technical Beginner's Guide

tblogs.site · 2 months ago

There are three architectural pillars for getting the most from Claude AI: structured XML prompting that separates instructions, context, and rules to force deterministic behavior, multi file Projects that provide persistent knowledge and workspace isolation for large codebases, and Artifacts that render and let users interact with live code, SVGs, and web elements in a side by side development window. Effective use requires pruning noisy files before loading the platform's 200000 token context window, seeding Projects with targeted documentation to avoid repetitive prompting, and enabling Artifacts in feature previews to test and iterate quickly. Recommended practices include treating prompts as tagged metadata to prevent attention loss, excluding heavy directories to save tokens and reduce latency, and monitoring Pro tier usage limits to avoid throttling.
Tech billionaires used performance drugs in secret. Now they’re selling a revolution.

www.washingtonpost.com · 2 months ago

There is a Silicon Valley backed athletic tournament called the Enhanced Games that encourages medically supervised use of steroids, hormones, peptides and other legal performance enhancing drugs and staged an inaugural event in Las Vegas. Investors include Peter Thiel and 1789 Capital, the company recently had a reported valuation of 1.2 billion dollars and plans to use the spectacle to mainstream and sell longevity and enhancement therapies through a telehealth platform. Organizers said 36 of 42 athletes doped in preparation, with reported usage rates of 91 percent testosterone, 79 percent human growth hormone, 62 percent stimulants, 50 percent metabolic modulators, 41 percent EPO and 29 percent anabolic agents, and athletes can earn million dollar bonuses for breaking certain records. Medical and anti doping experts and organizations warn the concept is dangerous and unethical, citing unclear long term safety for stacked or off label use of powerful drugs and the risk of normalizing performance enhancing drug use among children and other athletes.
UK Institute Is Hunting for Dangers Lurking in AI

www.nytimes.com · 2 months ago

The United Kingdom's AI Security Institute is staffed by senior alumni from OpenAI and Google DeepMind and operates within the Department of Science, Innovation and Technology. It conducts independent pre deployment testing of frontier AI systems, has released open source evaluation tools, and has published assessments that include prerelease testing of major models. The institute has attracted industry funding and formal cooperation from major firms including OpenAI and Microsoft and is being used as a model for international coordination on emerging AI risks.
Laravel Lang packages hijacked to deploy credential-stealing malware

www.bleepingcomputer.com · 2 months ago

There was a supply chain attack against Laravel Lang localization packages that abused GitHub version tags to distribute malicious Composer releases. Attackers rewrote hundreds of historical git tags across multiple repositories to point to malicious commits in attacker controlled forks, which autoloaded a malicious helpers file that acted as a dropper for a second payload. The second payload is a large cross platform credential stealer that harvests cloud credentials, Kubernetes secrets, Vault tokens, Git and continuous integration secrets, SSH keys, browser data and encryption keys, cryptocurrency wallets, password manager data, VPN configurations and local environment files, and the Windows component named DebugElevator targets Chromium based browsers to extract browser encryption keys. Packagist removed the malicious versions and temporarily unlisted the affected packages, and developers are advised to review installed package versions, rotate any exposed credentials and inspect systems for indicators of compromise.
npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks

thehackernews.com · 2 months ago

There is a staged publishing feature on npm that requires a human maintainer to complete a two factor authentication challenge to approve a prebuilt tarball in a staging queue before the package becomes publicly installable. To use staged publishing a maintainer must have publish access, the package must already exist on the registry, and the account must have two factor authentication enabled, and the npm stage publish command requires npm CLI 11.15.0 or newer. npm also added three install source flags, --allow-file to control installs from local files and tarballs, --allow-remote to control installs from remote URLs, and --allow-directory to control installs from local directories, enabling an explicit allowlist for non registry install sources. The changes are intended to strengthen the software supply chain after a recent surge in package poisoning campaigns by threat actors such as TeamPCP.
Packagist Supply Chain Attack Infects 8 Packages Using GitHub-Hosted Linux Malware

thehackernews.com · 2 months ago

A coordinated supply chain campaign infected eight Packagist packages with malicious code that downloads a Linux binary from a GitHub Releases location, saves it to the /tmp/.sshd folder, grants execute permissions, and runs it in the background. The attacker placed postinstall scripts in package.json rather than composer.json to target projects that ship JavaScript build tooling alongside PHP, and the malicious package versions have been removed from Packagist. Investigators found references to the same payload across hundreds of GitHub files and in at least two GitHub Actions workflows, and the installer attempts to hide activity by disabling TLS verification, suppressing errors, and enabling remote code execution during installation and build workflows while the second stage binary is currently unavailable.
Italy disrupts CINEMAGOAL piracy app that stole streaming auth codes

www.bleepingcomputer.com · 2 months ago

Italian authorities dismantled a piracy ecosystem built around the CINEMAGOAL app that provided access to multiple legitimate streaming services including Netflix, Disney Plus, Spotify, Sky, and DAZN, executing a large operation called Tutto Chiaro with 100 searches and seizures of servers in France and Germany. The app connected directly to legitimate platforms by fetching valid authentication and decryption codes from foreign servers, used virtual machines in Italy to capture codes from subscriptions created with false identification every three minutes, redistributed those codes to customers, and masked users IP addresses to evade blocks. Authorities reported more than 70 resellers, annual subscriptions priced between 40 and 130 euros with payments via cryptocurrency or foreign bank accounts, estimated damages around 300 million euros, penalties already issued to the first 1,000 subscribers ranging from 154 to 5,000 euros, and that a pezzotto IPTV service was also dismantled as the investigation continues.
Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software

thehackernews.com · 2 months ago

Project Glasswing has surfaced more than 10,000 high or critical vulnerabilities across systemically important software since launching last month, with 6,202 initially classified as high or critical across more than 1,000 open source projects and triage confirming 1,726 true positives of which 1,094 are high or critical. One notable finding is a critical wolfSSL certificate verification flaw tracked as CVE-2026-5194 with a CVSS score of 9.1 that can allow attackers to forge certificates and impersonate legitimate services. Companies and defenders are being urged to shorten patch cycles, harden default configurations, enforce multi factor authentication, and maintain comprehensive logs while Anthropic provides a Cyber Verification Program and other tools to help validate and remediate vulnerabilities.
‘Underminr’ Vulnerability Lets Attackers Hide Malicious Connections Behind Trusted Domains

www.securityweek.com · 2 months ago

There is a vulnerability named Underminr that affects roughly 88 million domains and lets attackers hide malicious connections behind trusted domains by abusing shared content delivery network infrastructure. The technique presents the SNI and HTTP Host of one domain while forcing the request to the IP address of another tenant, enabling attackers to bypass DNS filtering and conceal command and control, VPN, and proxy traffic even where domain fronting mitigations exist. ADAMnetworks reports the flaw can be abused with four strategies to evade Protective DNS and has been observed against large hosting providers, with internet infrastructure in the United States, the United Kingdom, and Canada most impacted. Security teams are warned that increased use of AI could accelerate attacks that weaponize this capability.
Hackers Exploit F5 BIG-IP to Gain SSH Access and Pivot Into Linux Networks

gbhackers.com · 2 months ago

Threat actors are exploiting end of life F5 BIG-IP appliances to gain unauthorized SSH access and use compromised devices as launchpads for multi stage intrusion campaigns that pivot into Linux hosts, an internal Confluence server, and Active Directory infrastructure. Microsoft Threat Intelligence disclosed the full attack chain on May 22, 2026, showing initial access to an Azure hosted F5 BIG-IP Virtual Edition running version 15.1.201000 which reached end of life on December 31, 2024. The campaign leverages a reclassified remote code execution flaw tracked as CVE-2025-53521 and an NTLM relay weakness tracked as CVE-2025-33073 to move from edge appliances to domain level compromise. Recommended mitigations include retiring end of life appliances, urgently patching internal applications such as Confluence, disabling or minimizing NTLM and enforcing SMB signing, implementing tiered administration, and enabling Microsoft Defender for Endpoint in block mode.
Hackers Exploit F5 BIG-IP to Gain SSH Access and Pivot Into Linux Networks

gbhackers.com · 2 months ago

There are active attacks exploiting end of life F5 BIG IP appliances to gain unauthorized SSH access and use the devices as launchpads to pivot into enterprise Linux hosts, internal Confluence servers, and Active Directory environments. Microsoft Threat Intelligence disclosed the full attack chain on May 22, 2026, tracing initial access to an Azure hosted F5 BIG IP Virtual Edition running version 15.1.201000 which reached end of life on December 31, 2024. The campaign leverages a critical F5 flaw tracked as CVE-2025-53521 which was reclassified as remote code execution in March 2026 and added to known exploited vulnerabilities, and the actor later abused an unpatched Confluence instance to harvest credentials and perform Kerberos relay attacks exploiting CVE-2025-33073. Recommended mitigations include retiring end of life appliances, urgently patching internal applications, disabling or minimizing NTLM and enforcing SMB signing, enabling endpoint protection in block mode on Linux servers, and implementing a tiered administration model.
Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer

thehackernews.com · 2 months ago

A software supply chain attack compromised multiple Laravel-Lang PHP packages, including laravel-lang lang, laravel-lang http-statuses, laravel-lang attributes, and laravel-lang actions, with more than 700 republished versions and malicious tags pushed rapidly on May 22 and May 23, 2026. A malicious file named src helpers.php, registered for automatic loading, fingerprinted hosts and contacted a remote command and control server to fetch a cross platform payload that executes on Windows, Linux, and macOS. The dropper delivers a Visual Basic Script launcher on Windows and executes native payloads on Linux and macOS, while a roughly 5,900 line PHP stealer with fifteen collector modules harvests cloud credentials, tokens, cryptocurrency seed phrases, browser and password manager data, development and infrastructure secrets, encrypts the results, and deletes itself.
LiteSpeed cPanel Plugin 0-Day Exploited for Server Root Access

gbhackers.com · 2 months ago

A critical zero-day privilege escalation in the LiteSpeed User-End cPanel plugin is being actively exploited in the wild, allowing any authenticated cPanel user to execute arbitrary scripts as root and gain full server control. The flaw is a logic bug in the lsws.redisAble JSON API endpoint exposed to all logged-in cPanel users, is tracked as CVE-2026-48172 with a maximum CVSS score of 10.0, and was patched on May 21, 2026; the cPanel ecosystem also saw related advisories including CVE-2026-41940. Administrators are advised to detect exploitation attempts by searching cPanel access logs for calls to the redisAble API and to assume compromise if found, rotating credentials, auditing cron jobs and authorized keys. Mitigation steps include upgrading to LiteSpeed WHM Plugin version 5.3.1.0 bundled with cPanel Plugin version 2.4.7, forcing a full cPanel update, or uninstalling the vulnerable plugin to immediately remove the attack surface.
‘It’s called winning’: Why a tech industry super PAC is running ads about ICE

www.washingtonpost.com · 2 months ago

There are rival deep pocketed super PACs and nonprofit networks funded by factions inside the AI industry that have poured tens of millions of dollars into midterm congressional primaries, using sharply targeted TV, radio and social media ads that often do not mention artificial intelligence. Public First, linked to the AI company Anthropic, spent about 1.6 million dollars in North Carolina’s fourth district and has raised additional funds, while a rival network called Leading the Future has attracted roughly 140 million dollars from Trump aligned tech leaders. The spending is aimed at shaping policy priorities including AI regulation, data center permitting and export controls, and critics say the interventions highlight donor opacity and how corporate factions are influencing political outcomes.
Ubiquiti Patches Critical UniFi OS Privilege Escalation Flaws

gbhackers.com · 2 months ago

There are five critical and high severity UniFi OS vulnerabilities that allow remote command execution, privilege escalation, improper access control, and path traversal across many UniFi devices including Dream Machines, Network Video Recorders, and Cloud Gateways. The flaws are tracked as CVE-2026-33000, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, and CVE-2026-34911, with CVE-2026-33000 enabling command injection with privileged access, CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 rated CVSS 10.0 and exploitable without authentication, and CVE-2026-34911 a high severity path traversal requiring low privileges. Administrators should treat these as emergency updates and immediately apply vendor patches such as UniFi OS Server to version 5.0.8, most devices to 5.1.12, Express to 4.0.14, and UNAS appliances to 5.1.10.
Hackers Use SEO Poisoning to Fake Gemini CLI, Claude Installers

gbhackers.com · 2 months ago

There is an active financially motivated campaign first identified in early March 2026 that uses SEO poisoning and paid ads to impersonate AI developer tools and trick developers into running a single paste and execute PowerShell or mshta command. The lure runs a visible legitimate install command while silently memory executing a second stage fileless PowerShell infostealer or an HTA payload appended to a genuine MSIX bundle, which disables event tracing for Windows, bypasses AMSI, and harvests browser credentials, session tokens, SSH keys, cloud synced files, and CI and CD credentials. Stolen session cookies bypass multifactor authentication and the actor uses rotating lures and bulletproof hosts to target developer workstations across sectors worldwide, so teams should hunt for download cradle patterns, enforce constrained PowerShell modes, and apply stronger account protections.
Pardon MIE?: how Mythos did not bypass Apple MIE

ironpeak.be · 2 months ago

There is a bypass of Apple Memory Integrity Enforcement on M5 silicon that exploits an integer overflow in the kernel function zallocromut to make target plus length wrap past 64 bits, allowing a single oversized memcpy to overwrite read only zone structures such as ucred and flip an effective user ID to root. This issue is tracked as CVE-2026-28952 and was developed into a local unprivileged to root exploit by Calif with assistance from Anthropic’s Mythos in roughly five days. Apple released a minimal two instruction patch in macOS Tahoe 26.5 that adds per CPU bound checks in zallocromut to prevent the wraparound used by the exploit. The chain demonstrates that hardware memory tagging and page table enforced read only zones can still be defeated by carefully crafted data only attacks and integer overflows, narrowing the time between disclosure and working exploit and making timely patching critical for affected systems.
LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root

thehackernews.com · 2 months ago

A maximum-severity vulnerability in the LiteSpeed user-end cPanel plugin is being actively exploited to run arbitrary scripts as root by abusing incorrect privilege assignment in the lsws.redisAble function. The flaw is tracked as CVE-2026-48172 with a CVSS score of 10.0, affects plugin versions 2.3 through 2.4.4, and was reported by researcher David Strydom. Administrators should search cPanel logs for entries referencing the API parameter named cpanel jsonapi func or the redisAble function to detect compromise, upgrade to cPanel plugin version 2.4.7 bundled with WHM plugin 5.3.1.0, or remove the user-end plugin if patching is not immediately possible. This disclosure follows a recent actively exploited cPanel vulnerability CVE-2026-41940 that was used to deploy Mirai botnet variants and the Sorry ransomware, underscoring the urgent need to patch.
Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV

thehackernews.com · 2 months ago

CISA added CVE-2026-9082, an SQL injection vulnerability in Drupal Core with CVSS score 6.5, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation, and the flaw can allow privilege escalation and remote code execution via specially crafted requests using the database abstraction API. Patches are available for Drupal 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, and 10.4.10, with manual updates required for Drupal 9.5 and 8.9, and Federal Civilian Executive Branch agencies were advised to apply fixes by May 27, 2026. Drupal confirmed exploit attempts on May 22, 2026, and security firm Imperva reported observing over fifteen thousand attack attempts against almost six thousand sites across sixty five countries, primarily probing gaming and financial services sites and targeting PostgreSQL backed configurations, with activity that could rapidly move from reconnaissance to data extraction or privilege escalation if successful.
Hackers Compromise Laravel-Lang Packages via 700 GitHub Repos

gbhackers.com · 2 months ago

A sophisticated supply chain attack compromised more than seven hundred historical package versions across four Laravel Lang PHP localization repositories, with malicious Git tags published in rapid succession on May 22 and May 23, 2026. The attacker added a malicious src/helpers.php registered under composer autoload.files that executes automatically when Composer's autoloader runs, delivering a remote code execution backdoor that fetches and runs a second stage payload. The second stage is a cross platform PHP credential stealer that harvests cloud metadata and service tokens, CI and developer credentials, browser and password manager data, and cryptocurrency wallets before exfiltration, prompting Packagist to remove the malicious versions and urging teams to treat impacted hosts as fully compromised, rotate secrets, block affected package versions, and rebuild from known good images.
Claude Mythos Preview Discovers 10,000+ 0-Days in Glasswing

gbhackers.com · 2 months ago

Anthropic's Project Glasswing, powered by the Claude Mythos model, surfaced more than ten thousand high or critical zero day vulnerabilities after scanning over one thousand open source projects, generating 23,019 candidate findings and yielding 1,726 confirmed true positives from 1,900 items sent for formal review, a 90.8 percent true positive rate. The surge has created a remediation bottleneck, with 1,596 findings reported to maintainers, 1,451 acknowledgements, only 97 upstream patches and 88 published advisories as of May 22, 2026, and 827 confirmed high or critical vulnerabilities still awaiting disclosure while some maintainers have asked Anthropic to slow disclosures. A notable exploit against the wolfSSL library that could forge TLS certificates was patched and assigned CVE-2026-5194, Mythos helped Mozilla fix 271 issues in Firefox 150, and the model outperformed prior systems on academic and industry benchmarks and solved previously unsolvable cyber range simulations. To help address scale, Anthropic launched Claude Security in public beta for enterprises, released scanning skills, codebase mapping tools and a Cyber Verification Program, and partnered with open source initiatives to assist maintainers.
Google leaks details for Chromium bug that can turn browsers into bots

www.csoonline.com · 2 months ago

An unpatched vulnerability in Chromium can let attackers execute JavaScript persistently across browser restarts, enabling hijacked browsers to be used for distributed denial of service attacks, running crypto miners, persistent tracking, and other abuses. The flaw, reported more than three years ago by researcher Lyra Rebane, exploits the Service Worker feature and the Background Fetch API by repeatedly creating and aborting background fetches to keep service workers alive, and technical details were briefly exposed in the project bug tracker before the entry was set private. Some browser UI visibility issues were patched in January 2023, but the deeper persistence mechanism remains and would require a specification level fix to introduce a hard time limit for quitting service workers. The exploit can execute remote JavaScript and WebAssembly payloads, harvest browser open timestamps IP addresses and User Agent information, or trigger cross site requests that could be used to build botnets of compromised browsers.
Waymo Suspends Service in Six Cities After Cars Drove Into Flooded Roads

www.nytimes.com · 2 months ago

There are temporary suspensions of Waymo robotaxi service in Atlanta and parts of Texas after videos showed unoccupied Waymo vehicles stopped on flooded Atlanta streets during a sudden downpour on Wednesday. Waymo said the vehicles stopped after encountering deep water, the cars were recovered, and the company paused operations while it updates software to improve handling of flooded roadways and construction zones and has suspended freeway rides in several U.S. cities. There were no reported injuries and the company described the pause as an abundance of caution ahead of forecasted severe weather.
Friday Squid Blogging: Regulating Squid Fishing in the South Pacific

www.schneier.com · 2 months ago

A call has been made for the South Pacific Regional Fisheries Management Organization to regulate squid fishing in the South Pacific to address expanding fishing activity. The post also invites readers to discuss related security stories and notes the site’s blog moderation policy.
CVE-2026-9256 - "nginx-poolslip", another new vulnerability in the rewrite module

my.f5.com · 2 months ago

NULL
AI Security CTF (free, open) - prompt injection, agent workflow hijacking, guardrail bypass - June 17-22

kubearmor.io · 2 months ago

There is an AI security capture the flag created by the KubeArmor developer relations team that runs entirely in the browser and focuses on AI specific attack surfaces often missing from traditional CTFs. It contains three tracks with 18 challenges: Prompt Injection Lab, covering system instruction override, persona drift via roleplay and translation, multi turn memory manipulation, indirect injection through poisoned context, and guardrail filter bypass; Agent Workflow Hijack, covering coercing agent tool misuse, poisoning indexed sources with hidden instructions, manipulating fake approval gates, exploiting agent memory as a prompt injection surface, and chaining tool calls to exfiltrate secrets; and Hidden API and Guardrail Bypass, covering triggering debug endpoints, tampering safety mode parameters via developer tools, abusing export features for data leaks, intercepting streamed responses before redaction, and replaying weak preview tokens. The event runs in the browser with no cluster access or local tools required, is free for individual play, scored on CTFd, runs June 17 through June 22, and awards more than one thousand dollars in prizes to top performers.
Just added an interactive security map to my project NoEyes showing exactly what the server sees (and doesn't)

ymsniper.github.io · 2 months ago

NoEyes is a security architecture at version 0.5 that provides end to end encryption and zero metadata routing implemented in Python using PyNaCl and cryptography. The design is organized into security layers including crypto primitives, key hierarchy, zero metadata routing, forward secrecy, identity and trust on first use, transport and TLS, access and denial of service protection, and file transfer. An interactive map interface allows nodes to be inspected and supports scroll to zoom and drag to pan for exploration of the architecture.