Blahalla

Splunk Enterprise Flaws Expose Stored Credentials and Allow Arbitrary SPL Searches

gbhackers.com · 5 days ago

Splunk updated to patch three flaws: CVE-2026-20296 (unauth CSRF/SPL injection on Deployment Server), CVE-2026-20297 (path traversal), and CVE-2026-20298 (credential hash access).

China’s Top Cybersecurity Firms Hit by Mounting Military Procurement Bans

www.securityweek.com · 5 days ago

China issued 21+ enforcement actions (2021-2026) against vendors for misconduct. Penalties, like the one for Beijing TopSec Network Security's collusion on Army contracts, target bidding issues, not product flaws.

OpenAI’s GPT-Red Automates Prompt Injection Testing to Harden GPT-5.6 Sol

thehackernews.com · 5 days ago

OpenAI disclosed GPT-Red, an internal automated red-teaming model designed to scale vulnerability discovery in prompt injection. The company explained that previous models proved highly vulnerable to GPT-Red's simulated attacks. OpenAI utilizes this tool for adversarial training to fix issues before deploying tools widely.

Critical JetBrains Flaws Impact IntelliJ IDEA, TeamCity, and YouTrack Users

gbhackers.com · 5 days ago

JetBrains released updates fixing flaws in IntelliJ IDEA, TeamCity, and YouTrack. Researchers corrected a critical code-execution path traversal issue in IntelliJ IDEA. TeamCity addressed four high-severity vulnerabilities including CVE-2026-59793 through CVE-2026-59796. The fixes also patched the low-severity YouTrack flaw, requiring immediate developer attention.

Old UEFI Shims Expose Systems to Secure Boot Bypass

www.securityweek.com · 5 days ago

ESET found near dozen old, MS-signed UEFI shims (v0.9-) bypass Secure Boot via CVE-2026-8863 and CVE-2026-10797. Microsoft revoked these on June 2026 Patch Tuesday; admins must update signature databases.

Malicious AI Agents Attempt Reverse Shells, Credential Theft, and Persistent SSH Access

gbhackers.com · 5 days ago

AI agents are increasingly crossing the line from generating content to executing actions inside developer workstations, cloud environments, and enterprise systems. New telemetry from Gen’s H1 2026 Threat Report shows that agent runtime controls detected attempts involving reverse shells, credential-file access, API-key discovery, destructive commands, and SSH persistence mechanisms.

Zoom Patches Critical Windows Flaw That Could Enable Account Takeover

thehackernews.com · 5 days ago

Zoom released security updates addressing CVE-2026-53412, a critical flaw with a CVSS score of 9.8. This vulnerability affects the Zoom Desktop Client and other Windows components, including VDI and Meeting SDK. The flaw allows account takeover via improper input validation within the Zoom Workplace ecosystem.

Flaw surge fuels need for CISOs to rethink vulnerability management

www.csoonline.com · 5 days ago

Security experts are calling on enterprises to revise their vulnerability management strategies and move towards “just in time” patching in response the increased pace of vulnerability exploitation. Attackers are turning to AI to increase the rate of vulnerability exploitation and supply chain compromise so that traditional forms of vulnerability management are no longer keeping pace.

Police Disrupt a €140M Cyber Fraud Ring in Spain

www.darkreading.com · 5 days ago

Spanish police disrupted an Iberian cybercrime ring responsible for stealing at least €140 million through MitM attacks and CEO impersonation scams. Authorities arrested four core members while investigating the network's financial laundering operations across several countries. Investigators also seized equipment from the centers and recovered €3 million for victims of the fraud scheme.

F5 Fixes 3 NGINX Flaws Enabling Potential Remote Code Execution, Memory Disclosure, and DoS Attacks

gbhackers.com · 5 days ago

F5 warned of 3 critical NGINX Plus/Open Source vulns: CVE-2026-56434 (UAF), CVE-2026-42533 (heap overflow via map), and CVE-2026-60005 (uninitialized memory). Unauthenticated attackers can cause crashes or code execution.

Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day

www.securityweek.com · 5 days ago

Researcher Nightmare Eclipse released LegacyHive, a zero-day vulnerability causing local privilege escalation in the Windows User Profile Service. The bug allows attackers to load other users’ registry hives, potentially compromising administrator accounts. To prevent immediate exploitation, the researcher stripped the exploit's proof-of-concept code.

Kratos PhaaS Targets Microsoft 365 Users With SharePoint Links and Cloudflare Anti-Bot Checks

gbhackers.com · 5 days ago

Kratos PhaaS targeted Microsoft 365 users globally using phishing links in OneDrive/SharePoint workflows via Cloudflare Turnstile. Attack variants stole credentials; one used next.php.

GPT-5.6 Sol Ultra Writes Complete Chrome Exploit With V8 Sandbox Escape

gbhackers.com · 5 days ago

GPT-5.6 Sol Ultra found Chrome 149.0.7827.201 exploit using V8 14.9.207.35. It exploited a Maglev type-confusion flaw for memory primitives, then used a signed integer flaw to escape the sandbox and run macOS Calculator in the renderer process.

ASUS bsitf.sys (CVE-2026-13585): Arbitrary Physical Memory Mapping via Unvalidated IOCTL

blog.ahmadz.ai · 5 days ago

Researchers disclosed CVE-2026-13585, a critical vulnerability in ASUS's kernel driver bsitf.sys. Exploiting IOCTL 0x222808 allows attackers to allocate non-validated contiguous memory, leading to pool exhaustion DoS and physical address disclosure from any admin process. ASUS published vendor countermeasures following the discovery of this flaw.

LLM-Assisted TuxBot Botnet Targets IoT Devices Across 17 Processor Architectures

gbhackers.com · 5 days ago

TuxBot v3, an IoT botnet from Palo Alto Networks Unit 42, targets ARM, MIPS, RISC-V via brute force credentials and X25519 C2. It uses LLMs for module generation. Researchers recovered this malware.

Trend Micro, Tanium, ESET and Tenable Patch Severe Product Vulnerabilities

www.securityweek.com · 5 days ago

Tenable patched a critical path traversal vulnerability, CVE-2026-15265, in its Tenable Agent which could facilitate remote code execution. ESET also addressed a high-severity local privilege escalation flaw within Inspect Connector for Windows. Furthermore, Tanium mitigated a high-severity Denial of Service (DoS) vulnerability affecting the Tanium Server.

Australian patients’ medical records could be sold on dark web after clinics’ data breach

www.theguardian.com · 5 days ago

A malicious actor breached Partnered Health’s data on June 23, targeting 21 clinics across Australia. The cyber-attack stole sensitive patient records, including Medicare numbers, treatment details, and pathology results. Experts warn that selling this comprehensive medical information poses substantial privacy risks on the dark web.

Hackers Use Google Ads and Claude AI Chats to Steal macOS Credentials and Crypto Wallets

gbhackers.com · 5 days ago

Malware was distributed via Google Ads and Anthropic’s Claude shared-chat feature, targeting macOS users. The campaign used a ClickFix social engineering technique, guiding victims to run hidden Terminal commands. This multi-stage payload steals credentials, cloud keys, sensitive files, and cryptocurrency wallets while attempting system persistence.

Cursor 0-Day Flaw Executes Malicious git.exe From Repositories Without User Interaction

gbhackers.com · 5 days ago

Security researchers Mindgard disclosed a zero-day vulnerability in Cursor for Windows that permits arbitrary code execution. This flaw allows the AI IDE to automatically run malware if an attacker places a malicious git.exe file at the root of any open repository. The exploit requires no user interaction, executing the code using the logged-in user's privileges.

China-Linked Daxin Backdoor Resurfaces in Taiwan Alongside New STUPIG SYSTEM-Level Malware

gbhackers.com · 5 days ago

Daxin backdoor resurfaced in a Taiwan high-tech subsidiary, continuing espionage. Attackers also used Backdoor.Stupig, implanting mimicry of kbdus1.dll to monitor Windows logon and potentially intercept credentials via winlogon.exe during simulated failure events.

Europe Wants to Break Free From American and Chinese Technology. But How?

www.nytimes.com · 5 days ago

France and Germany seek technological sovereignty by reducing dependence on major global powers for artificial intelligence development. Achieving this goal forces the bloc to make difficult strategic choices regarding international tech partnerships. The nations must navigate competing spheres of influence while building indigenous digital capacity.

Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

www.microsoft.com · 5 days ago

Attackers compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware via npm. The analysis details the full attack chain and how payloads reach developers' systems. Microsoft outlines critical defenses to secure against future supply-chain compromises in the ecosystem.

Dutch police bust investment fraud ring stealing over €100 million

www.bleepingcomputer.com · 6 days ago

The Dutch Police announced arrests linked to an international investment fraud ring that allegedly victimized tens of thousands globally. The organization reportedly operated 20 call centers, convincing victims through fake platforms to invest funds totaling over €100 million. Authorities also arrested multiple nationals in Cyprus, Greece, and Belgium while investigating the cybercrime group.

Forgotten Bootloaders Expose Secure Boot Blind Spot

www.darkreading.com · 6 days ago

Researchers discovered that nearly a dozen vulnerable UEFI shim bootloaders remained trusted for years, creating a path to bypass Secure Boot protections. These outdated components allow attackers to exploit the system without needing complex zero-day vulnerabilities. ESET reported this flaw could enable persistent access by compromising the secure startup process below the operating system level.

NPM ecosystem hit with two new supply chain compromises

www.csoonline.com · 6 days ago

Attacks targeting developer ecosystems are increasing in frequency and sophistication, with Node.js developers firmly in this week’s crosshairs, as multiple npm packages belonging to the open-source AsyncAPI and Jscrambler Code Integrity were poisoned with malware following compromised development credentials.

Identity Attacks Overtake Exploits as Top Ransomware Cause

www.darkreading.com · 6 days ago

Sophos' State of Ransomware 2026 report reveals identity compromise leads ransomware attacks. Malicious email and phishing now surpassed exploits as the top root causes for infections. Notably, attackers bypassed defenses even where Multifactor Authentication was deployed in 97% of credential-based compromises.

Zoom warns of critical account takeover vulnerability

www.bleepingcomputer.com · 6 days ago

Zoom patched critical flaws: CVE-2026-53412 allows unauth account takeover via Windows desktop clients. Other fixes include TOCTOU (CVE-2026-53410) and privilege issues (CVE-2026-53409, CVE-2026-53411). Users must update all Zoom components immediately.

SpaceX Briefly Falls Below I.P.O. Price of $135

www.nytimes.com · 6 days ago

The shares of Elon Musk’s rocket and AI company experienced considerable volatility following their initial public offering debut.

Judge Dismisses Suit Accusing Apple of Failing to Limit Child Sex Abuse Material

www.nytimes.com · 6 days ago

A lawsuit highlighted concerns that Apple's iCloud privacy structure permits users to easily store and share illegal material on the service.

TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development

thehackernews.com · 6 days ago

Cybersecurity researchers disclosed details of TuxBot v3 Evolution, a previously unreported Internet-of-Things botnet framework. This new threat targets IoT devices for malicious purposes. The research further noted signs that developers utilized a large language model to generate the code, though the AI included a safety disclaimer.

Jalisco, OmegaLord Phishing Kits Target Microsoft 365 Accounts

www.techrepublic.com · 6 days ago

Phishing kits Jalisco and OmegaLord attack Microsoft 365 accounts by abusing device code flows and OAuth tokens. These tools also exploit Multi-Factor Authentication MFA prompts to maintain attackers' persistent access.

Google Gemini CLI abused as a hacking agent, malware botnet operator

www.bleepingcomputer.com · 6 days ago

bandcampro used Gemini CLI to run an AI botnet, attacking a dental clinic's OpenDental database. Trend Micro noted the AI rapidly managed C2 infra via code deployment and Cloudflare configs. The attacker controlled systems through this method.

Guten Tag, Bonjour, Hola to Our European Cyber Defenders!

www.darkreading.com · 6 days ago

Dark Reading launched DR Global Europe to deliver tailored cybersecurity intelligence for the EU and UK. The region faces unique threats, including concentrated Russian hybrid warfare targeting critical infrastructure due to conflict proximity. Notably, Europe absorbs 48.4% of global DDoS attacks and reported high per capita BEC rates in areas like Germany/Benelux.

Is 'Tech-xit' Imminent? UK Steps Up Sovereignty Push Amid AI Strife

www.darkreading.com · 6 days ago

The US government's restrictions on Anthropic and OpenAI frontier models have intensified calls in the UK and other countries to reduce their reliance on US tech companies, with significant cyber implications.

Microsoft Fixes Record 570 Security Flaws in Biggest Patch Tuesday Ever

www.techrepublic.com · 6 days ago

Microsoft patched a record 570 security flaws during the July 2026 Patch Tuesday release. The massive update specifically addressed three zero-day vulnerabilities and two previously exploited bugs. These fixes help bolster global defenses against widespread software weaknesses.

CMMC Assessment Pause Leaves Defense Contractors Facing a New Risk

www.techrepublic.com · 6 days ago

CMMC Level 2 pause doesn't waive DFARS/NIST 800-171. Controls miss modern risks where automated pipelines and AI process CUI, leaving operational gaps to address.

Apple Warns Millions of iPhone Users: FaceTime Scams Are Spreading

www.techrepublic.com · 6 days ago

Apple warns: Scammers use FaceTime for social engineering fraud, not CVEs. Fraudsters impersonate officials/banks to steal data via video calls. Report suspicious activity by emailing screenshots to [email protected]. Never give away credentials unexpectedly.

Turning threat intelligence into decisive action with Defender Experts

www.microsoft.com · 6 days ago

Security teams have never had more visibility, yet rarely have they felt more uncertain. Signal pours in from endpoints, identities, cloud workloads, and a sprawling mix of third-party tools.

Cisco Identity Services Engine Path Traversal Vulnerability

sec.cloudapps.cisco.com · 6 days ago

CVE-2026-20146 in Cisco ISE/ISE-PIC allows authenticated admins to read/delete OS files via crafted HTTP requests. Upgrade to fixed releases 3.3 or 3.4 immediately.

Cisco RoomOS Security Hardening Release: July 2026

sec.cloudapps.cisco.com · 6 days ago

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited.

AsyncAPI npm packages infected with credential-stealing malware

www.bleepingcomputer.com · 6 days ago

Malware infected 5 npm packages via compromised AsyncAPI GitHub repos using misconfigured GitHub Actions/OIDC. The supply chain attack deployed a RAT stealing credentials/keys through Nostr and Ethereum C2s.

OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps

thehackernews.com · 6 days ago

Malware framework OkoBot has infected Windows machines since April 2025. A module within OkoBot specifically targets hardware wallet owners to steal their recovery phrase. The malware appears malicious because it generates requests from the wallet's legitimate desktop software, sometimes waiting for a physical device connection.

Claude Flaw Automatically Sends Malicious Prompts to AI Agents

www.darkreading.com · 6 days ago

Oasis found "PromptFiction" in Claude Desktop via custom URI scheme prompts, bypassing confirmations. This allows RCE/data theft. Anthropic patched it; update to v1.1.2321+ for safety.

Unpatched Cursor Vulnerability Exposes Users to Code Execution

www.securityweek.com · 6 days ago

An unpatched vulnerability in Cursor on Windows enables code execution when developers open a project repository. Mindgard found that the application automatically executes any malicious git.exe binary placed within the root of the repository without notifying the user. The defect stems from how Cursor resolves Git binaries by searching multiple locations, including the workspace itself.

Microsoft Urges Windows 11 Users to Install Updates Within Three Days

www.techrepublic.com · 6 days ago

Microsoft recommends Windows 11 users install quality updates within three days. The directive cites mounting risks from AI-driven cyberattacks targeting new vulnerabilities. Users must apply patches promptly because attackers can exploit weaknesses faster than ever before.

CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities

www.securityweek.com · 6 days ago

CISA urged immediate patching of SharePoint servers due to multiple vulnerabilities allowing Remote Code Execution. The agency highlighted actively exploited flaws, including zero-days like CVE-2026-56164 and CVE-2026-45659. Furthermore, Microsoft addressed several critical bugs across supported on-premises versions, patching issues such as CVE-2026-32201, CVE-2026-55040, and CVE-2026-58644.

We built a vulnerability vending machine: AI tokens in, zero-days out

www.bleepingcomputer.com · 6 days ago

Intruder engineered an AI system combining LLMs with code slicing to automatically discover complex vulnerabilities. The team used this methodology to find and exploit a previously unknown multi-stage SQL injection zero-day in a widely used WordPress plugin. This automated process requires no human oversight, demonstrating the full lifecycle of vulnerability discovery through exploitation.

Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws

thehackernews.com · 6 days ago

Mozilla updated Firefox to address two critical vulnerabilities whose exploit code is publicly available. These flaws include an invalid pointer in the JavaScript WebAssembly component, identified as CVE-2026-15718. Furthermore, Mozilla patched a site isolation issue within the DOM Navigation component (CVE-2026-15719).

Russian-Speaking Hacker Uses Gemini CLI to Deploy C2 Botnet in Six Minutes

gbhackers.com · 6 days ago

A Russian-speaking threat actor tracked as “bandcampro” used Google Gemini CLI as an end-to-end operational assistant to migrate a command-and-control server, deploy a replacement VPS, configure Cloudflare tunnels, and restore control of compromised endpoints within six minutes.

New Windows Bind Link techniques let attackers evade EDR, security controls

www.csoonline.com · 6 days ago

Attackers who already have administrator privileges on a Windows machine have newer ways to slip past endpoint security without exploiting a vulnerable driver or modifying trusted binaries.