Blahalla

Exploit released for new PinTheft Arch Linux root escalation flaw

www.bleepingcomputer.com · 2 months ago

A publicly available proof of concept exploit targets a recently patched Linux local privilege escalation vulnerability named PinTheft and can grant local attackers a root shell on Arch Linux. PinTheft abuses an RDS zerocopy double free that can be converted into a page cache overwrite via iouring fixed buffers and requires the RDS kernel module to be loaded, iouring enabled, a readable SUID root binary, and x8664 support for the payload. Administrators are urged to install the latest kernel updates or mitigate risk by unloading or blacklisting the RDS module, and PinTheft is still awaiting assignment of a CVE identifier for tracking.
Typosquatting Is No Longer a User Problem. It's a Supply Chain Problem

thehackernews.com · 2 months ago

AI-driven typosquatting has shifted from a user problem to a supply chain problem by embedding lookalike domains inside legitimate third-party scripts so attackers can exfiltrate data without any user misstep or server breach. Large language models now generate thousands of convincing domain variants in minutes and full campaign deployment can take under ten minutes, making manual vetting ineffective. Traditional defenses such as firewalls, WAFs, EDR, and content security policies lack visibility into what approved scripts do at runtime, allowing malicious behavior in the browser to go undetected. Effective detection requires runtime behavioral monitoring and deobfuscation that traces what scripts actually access and transmit, with payment and authentication pages as the highest priorities.
Real-World ICS Security Tales From the Trenches

www.securityweek.com · 2 months ago

There are persistent, real-world ICS risks where threat actors establish long-term footholds using undocumented n-day vulnerabilities and attempt lateral movement from IT into OT, necessitating full-scope investigations to remove persistence. Operational errors and misconfigurations have caused live outages and exposures, including a vulnerability scan that stopped turbines, unauthorized contractor software installs at secure facilities, and unpatched systems with default credentials reachable from the internet. Shadow IT, legacy unsupported devices, and ineffective firewall deployments have left thousands of OT devices discoverable and increased attack surface, prompting urgent calls for comprehensive inventories, segmentation, and coordinated remediation.
Tracking TamperedChef Clusters via Certificate and Code Reuse

unit42.paloaltonetworks.com · 2 months ago

There are three distinct TamperedChef style clusters tracked as CL CRI 1089, CL UNK 1090 and CL UNK 1110, accounting for more than four thousand samples and about one hundred unique variants observed since 2023. These threats masquerade as legitimate productivity applications such as PDF editors and calendar apps, are distributed via malvertising and one click downloads, and commonly use valid code signing certificates, frequent binary rebuilds and long dormant periods to evade detection. Operators deliver remote access trojans, information stealers and proxy tooling after activation, and some clusters show vertical integration where the same actors control marketing and code signing. Defenders can link and track these campaigns using certificate reuse, code reuse and infrastructure overlaps, and telemetry shows global distribution with thousands of unique instances.
Virtual Event Today: Threat Detection & Incident Response Summit

www.securityweek.com · 2 months ago

A virtual Threat Detection and Incident Response Summit runs today from 11 AM to 4 PM Eastern Time. Sessions focus on cutting through alert fatigue, leveraging artificial intelligence and unified platforms to accelerate investigations, and applying actionable threat intelligence to improve threat detection and incident response.
GitHub Confirms Hack Impacting 3,800 Internal Repositories

www.securityweek.com · 2 months ago

GitHub confirmed that the TeamPCP hacking group accessed and exfiltrated roughly 3,800 internal repositories after a GitHub employee installed a poisoned VS Code extension. The attackers claimed theft of source code and internal organizations and offered the allegedly stolen data for sale for at least fifty thousand dollars. GitHub rotated critical secrets, prioritized highest-impact credentials, is analyzing logs and monitoring for follow-on activity, and said it will publish a full incident report later. Security researchers warn that VS Code extensions can access all data on a developer machine, making developer workstations a primary target in supply chain attacks.
These 5 charts show how ChatGPT is flooding our lives

www.washingtonpost.com · 2 months ago

There are five clear trends since ChatGPT’s release in late 2022: a surge in e-books, a rise in self‑represented lawsuits, an explosion of AI-generated music, a spike in low-quality scientific papers, and a growing share of AI-written web text. The number of e-books published each week has nearly tripled and by the end of 2025 more than half of new books contained AI-generated text, while in 2025 self-represented litigants made up about 17 percent of federal non-prisoner filings compared with a historical average of 11 percent. Deezer estimates more than 40 percent of new tracks are fully AI-generated, about 75,000 AI songs are uploaded daily, and arXiv tightened its rules in January 2026 after rejection rates climbed from roughly 4 percent to about 10 to 12 percent due to low-quality submissions and fake citations. Recent research by Imperial College London, the Internet Archive and Stanford found that as much as a third of new web content in a given month may be partly or wholly AI-generated.
Congrats, new grads! Welcome to job market hell.

www.washingtonpost.com · 2 months ago

There is mounting evidence that the Class of 2026 with computer science degrees is entering a more precarious job market as artificial intelligence and broader economic shifts have reduced hiring from traditional big technology employers. Data from a leading university show a noticeable drop in the share of new graduates taking jobs at the largest tech firms compared with a few years ago and report a typical starting salary around one hundred forty thousand dollars for recent computer science bachelor recipients, while researchers are divided on how much of the weakness is due to AI versus longer running industry and economic changes. Graduates are responding by widening career searches, pursuing interdisciplinary and hardware focused programs, relying more on internships and networks, and taking roles outside Silicon Valley as health care retail and other sectors seek data and AI skills.
Why some security fixes never reach your vulnerability dashboard

www.csoonline.com · 2 months ago

On April 22, 2026 a trojanized Bitwarden CLI package appeared on npm for roughly 90 minutes, with version 2026.4.0 executing an obfuscated loader that stole AWS, Azure, GCP, GitHub and npm tokens from developer machines that ran npm install. The incident was assigned CVE-2026-42994 nine days later, and CVE identifiers are framed as retroactive incident markers rather than actionable patch instructions, with related identifiers including CVE-2025-68664 in LangChain Core, CVE-2022-23812 for node ipc protestware, and CVE-2020-10148 for the SolarWinds backdoor. Many supply chain campaigns and agentic threats, including a self propagating npm worm from 2025 into 2026 and campaigns that enroll AI agents into third party networks, frequently escape artifact centric tracking because they mutate at runtime, are distributed through informal channels, or are quietly fixed without advisories. Security programs are advised to treat traditional vulnerability dashboards as increasingly incomplete and instead adopt behavioral identifiers, demand registry transparency for takedowns, and push vendors to disclose silent fixes to better cover model mediated and agent related risks.
Pardus Linux Vulnerability Lets Local Attackers Gain Silent Root Access

gbhackers.com · 2 months ago

There is a critical privilege escalation chain tracked as CVE-2026-5140 and rated CVSS 9.3 in the Pardus Linux update mechanism that allows any local unprivileged user to gain full root access without authentication. The chain affects the pardus-update package and combines three flaws: permissive Polkit policies permitting authorization bypass, a CRLF injection in configuration handling that fails to strip carriage return characters, and unsafe handling of attacker controlled APT source paths that let malicious repository files be copied into system sources and used to install packages that grant persistent root. Administrators should enforce admin authentication in Polkit policies, sanitize input to remove both carriage return and newline characters, validate APT source locations to trusted directories, and audit systems for unauthorized sources and unusual privilege escalations.
When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax

blog.doyensec.com · 2 months ago

There is an extended filename syntax in CFITSIO that functions as a mini language and can cause the library to perform complex file, network, and transformation operations when parsing filenames. There are four practical attack primitives demonstrated which include an arbitrary local file copy via the outfile clause that occurs before validation, forced downloads that let CFITSIO fetch remote resources and save them to attacker chosen local paths creating a persistent SSRF gadget, and HTTP request injection by embedding newline characters into filenames to add headers and reach cloud metadata services. There is also a chain that fabricates a minimal FITS image from arbitrary bytes using raw data and image selection features and then exfiltrates local files to a legacy root protocol server. Reproducible demonstrations were provided in a Docker playground, the findings were shared with NASA HEASARC on January 22, 2026, and recommended mitigations include using literal open routines instead of the extended filename syntax, making the feature opt in, sanitizing filenames, and restricting where the feature is used.
FBI warns students and staff that ShinyHunters may come knocking after Canvas breach

www.bitdefender.com · 2 months ago

On May 15, 2026 the FBI's Internet Crime Complaint Center issued an advisory warning that the ShinyHunters extortion gang breached an online learning management system used by educational institutions across the United States. Reporting and company confirmation indicate the platform was Canvas and that Instructure quietly confirmed on May 12, 2026 that it had reached an agreement with the attackers and paid a ransom after receiving digital confirmation of data destruction. The FBI warns extortionists commonly use harassment tactics including threatening texts and phone calls, swatting, false claims of compromising material, and spearphishing using stolen student and staff information, and advises victims not to engage and to await official guidance from their educational institution. Users are urged to enable multi factor authentication, avoid clicking suspicious links or unsolicited attachments, and recognize that ransom payments are likely to incentivize further attacks on learning platforms.
Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit

thehackernews.com · 2 months ago

Microsoft released a mitigation for a BitLocker bypass named YellowKey after its public disclosure. The zero-day is tracked as CVE-2026-45585 with a CVSS score of 6.8 and affects Windows 11 versions 24H2, 25H2, and 26H1 for x64 systems as well as Windows Server 2025 including Server Core. The flaw allows an attacker with physical access to place specially crafted FsTx files on a USB drive or EFI partition, boot into the Windows Recovery Environment, and trigger a shell with unrestricted access by holding the control key, and recommended mitigations include removing the autofstx.exe auto recovery utility from the WinRE BootExecute value after mounting and updating the WinRE image, and switching from TPM only protectors to TPM plus PIN to require a startup PIN.
GitHub confirms breach of 3,800 repos via malicious VSCode extension

www.bleepingcomputer.com · 2 months ago

GitHub confirmed that about 3,800 internal repositories were breached after an employee installed a malicious Visual Studio Code extension, and the extension has been removed and the compromised device secured. The activity appears to have involved exfiltration of internal repositories only, and there is no evidence so far that customer data outside the affected repositories was impacted. The TeamPCP cybercrime group claimed access and advertised roughly 4,000 private repositories for sale for at least fifty thousand dollars, and GitHub said it is continuing incident response and investigation.
Void Botnet Leverages Ethereum for Resilient C2

gbhackers.com · 2 months ago

A newly identified botnet named Void leverages Ethereum smart contracts as a resilient command and control channel, removing reliance on domains or centralized servers and making takedown efforts more difficult. Discovered in March 2026 and attributed to an operator using the alias TheVoidStl, the Rust based malware periodically polls public RPC endpoints every three to five minutes and supports a dual mode architecture that can switch between on chain encrypted commands and a centralized web control panel for near real time tasking. Operators can deploy executables, DLLs, MSI packages, and PowerShell scripts with in memory execution, reverse shell access, reverse proxying, self update and self delete functions, and the platform exposes detailed telemetry for each compromised host. Defenders are advised to prioritize proactive measures such as bot mitigation, behavioral detection, and network traffic analysis because traditional mitigation techniques targeting servers or domains are less effective against blockchain based command and control.
Microsoft shares mitigation for YellowKey Windows zero-day

www.bleepingcomputer.com · 2 months ago

A newly disclosed Windows BitLocker zero day called YellowKey allows access to protected drives and is being tracked as CVE-2026-45585. Exploitation involves placing specially crafted FsTx files on a USB drive or the EFI partition, rebooting into the Windows Recovery Environment, and triggering an unrestricted shell by holding down the CTRL key. Mitigations include removing the autofstx.exe entry from the Session Manager BootExecute registry value and reestablishing BitLocker trust for WinRE, switching BitLocker from TPM only to TPM plus PIN to require a preboot PIN, and enabling Require additional authentication at startup with Configure TPM startup PIN set to require a startup PIN via Intune or Group Policy. The researcher who published the proof of concept previously disclosed other Windows zero days including BlueHammer tracked as CVE-2026-33825.
Interpol's 'Operation Ramz' Pioneers Cross-Region Collabs in Middle East

www.darkreading.com · 2 months ago

There are 13 countries in the MENA region that collaborated with Interpol and cybersecurity firms in a five-month Operation Ramz to investigate cybercrime, identifying nearly 583 suspected cybercriminals and notifying nearly 4,000 victims. Investigations led to the seizure of 53 servers and dozens of cell phones, the arrest of 201 suspects, takedowns of malicious infrastructure including a phishing-as-a-service provider in Algeria, and disruption of an investment fraud ring in Jordan that exploited trafficking victims. Private threat intelligence partners including Group-IB, Kaspersky, the Shadowserver Foundation, Team Cymru, and TrendAI supported the operation, and Interpol described it as the first large-scale cross-region cybercrime collaboration in the Islamic region.
New NGINX Vulnerability Exposes Servers to Malicious Code Execution

gbhackers.com · 2 months ago

A new high severity vulnerability has been disclosed in the NGINX JavaScript module that can allow remote attackers to crash servers and in specific conditions execute arbitrary code on vulnerable systems. The flaw involves the njs module when the js fetch proxy directive is used together with client controlled NGINX variables, enabling exploitation by crafted requests. F5 published a security advisory identified as K000161307 that details the issue and impacted configurations. Administrators are advised to review any use of js fetch proxy with client controlled variables and apply vendor mitigations or updates promptly to prevent crashes or code execution.
Trapdoor Android Ad Fraud Ring Abuses 455 Apps for Fake Clicks

gbhackers.com · 2 months ago

A large-scale Android ad fraud campaign named Trapdoor built an ecosystem of 455 malicious apps and 183 command and control domains that at its peak generated about 659 million bid requests per day and whose associated apps were downloaded more than 24 million times. The operation distributes seemingly legitimate utility apps that install secondary payloads which deploy invisible WebViews loading attacker controlled HTML5 domains and execute scripted tap and swipe gestures from files such as move.txt and click.txt to generate automated ad clicks while abusing mobile install attribution to selectively activate only when installs originate from attacker controlled ad campaigns. To evade detection the campaign checks for rooted devices, debugging environments, and VPN use, employs native code packing, string encryption, code virtualization, and SDK impersonation, and researchers at HUMAN Satori Threat Intelligence have identified and disrupted the operation and deployed advertising security protections although the actors continue to release new apps and rotate infrastructure.
FreePBX Security Flaw Lets Attackers Access User Portals

gbhackers.com · 2 months ago

A critical vulnerability in FreePBX allows unauthenticated attackers to access User Control Panel portals when hard coded template credentials are left unchanged. It is tracked as CVE-2026-46376 with a CVSS v4 base score of 9.1 and stems from hard coded credentials introduced during optional UCP template setup. The issue affects the userman module in FreePBX 16 versions before 16.0.45 and FreePBX 17 versions before 17.0.7 and can be exploited remotely without authentication. Administrators should update to patched versions, change or randomize template credentials, restrict Administrator Control Panel access with VPN or MFA, and limit UCP and ACP exposure using firewall rules.
DevilNFC Malware Traps Android Users in NFC Relay Attacks

gbhackers.com · 2 months ago

DevilNFC is an Android malware family that uses kiosk mode to trap victims during NFC relay attacks and is linked to Spanish-speaking operators while a related family called NFCMultiPay shows Brazilian Portuguese links, signaling a regional shift toward locally developed tooling. A single APK operates as an NFC reader on unrooted victim phones and as a system-level card emulator on rooted attacker devices by hooking NFC communications, locks the device in a full-screen kiosk interface to prompt card taps and PIN entry, and intercepts SMS one-time passwords for real-time exfiltration to attacker servers and Telegram channels. NFCMultiPay uses a Java-only, non-root approach that relies on two devices and a cloud relay, replaces REST polling with MQTT over TCP port 1883 to reduce latency, and both families show signs of AI-assisted development and reuse of open source tools. Observed indicators of compromise include IP addresses 185.203.116.18 and 47.253.167.219, MD5 hashes caa5e8cf3275339d251210072ebe88c2 and 35dd9c3a56e88a39bf6c8fdad46b0398, and the package name com.devilnfc.reader.
Mini Shai-Hulud Attack Hits npm Ecosystem, Compromising Over 600 Packages

gbhackers.com · 2 months ago

A large scale supply chain attack against the npm ecosystem used a new Mini Shai Hulud variant to compromise more than 600 package versions across hundreds of packages, primarily targeting the antv ecosystem during a 27 minute window on May 19, 2026. Attackers forged Sigstore provenance by generating valid Fulcio certificates and Rekor entries with stolen credentials and CI tokens, then executed malware via phantom optional dependencies and obfuscated preinstall payloads that harvest GitHub and npm tokens, cloud credentials, Vault and CI secrets, and modify local project files for persistence. Exfiltration used encrypted channels including session based peer to peer over HTTPS with AES 256 GCM and RSA OAEP and fallback GitHub repositories, and researchers recommend avoiding affected updates, pinning dependencies, disabling install lifecycle scripts, rotating credentials if affected packages were installed on May 19, 2026, and monitoring CI and package publishing activity.
Single-Letter Go Module Typosquat Drops DNS-Based Backdoor

gbhackers.com · 2 months ago

A software supply chain attack targeted Go developers by publishing a single-letter typosquatted module that impersonated the widely trusted shopspring decimal library and preserved normal arithmetic behavior while embedding a stealthy backdoor. The malicious module remained benign for years before a v1.3.3 release on August 19, 2023 introduced an init function that starts a background goroutine which polls a command and control channel via DNS TXT records every five minutes and executes returned text as system commands. Because Go’s module proxy caches published modules indefinitely, the compromised version remains retrievable even after repository removal, creating ongoing risk to builds, CI pipelines, and production systems; impacted projects should audit dependencies, replace the typosquatted module with the legitimate package, rotate credentials, and rebuild environments from trusted sources.
PoC Exploit Released for DirtyDecrypt Linux Kernel Vulnerability

gbhackers.com · 2 months ago

There is a public proof of concept exploit for DirtyDecrypt also called DirtyCBC that turns a theoretical local privilege escalation into a practical copy paste path to root on kernels with RxGK enabled. The bug in rxgkdecryptskb decrypts before verifying the MAC and lacks a proper copy on write guard, allowing attacker controlled ciphertext to be written into aliased page cache pages and to poison readable SUID binaries or privileged files to escalate to root. Affected systems are kernels built with CONFIGRXGK enabled, notably Fedora, Arch Linux and rolling openSUSE builds, and the issue is associated with CVE 2026 31635 while related hardening work is tracked under CVE 2026 43284 and CVE 2026 43500. Mitigations include applying April 2026 and May 10 2026 kernel commits that copy RxRPC packets to avoid in place decrypt, or temporarily unloading and blacklisting esp4 esp6 and rxrpc until patched, plus monitoring for module loads and suspicious UID changing activity.
Hackers Exploit MSHTA to Deploy LummaStealer and Amatera Malware

gbhackers.com · 2 months ago

There is a surge in the abuse of the legacy Microsoft HTML Application Host mshta.exe as a living off the land loader to deliver commodity malware such as LummaStealer and Amatera because MSHTA remains enabled by default in Windows despite Internet Explorer being retired. Attack chains use multi stage fileless techniques where MSHTA fetches remote HTA scripts that execute VBScript or JavaScript and then stage additional payloads via PowerShell WScript or msiexec, with social engineering lures such as fake downloads pirated software clipboard paste CAPTCHA tricks and Discord phishing used to initiate infections. Recommended mitigations include avoiding untrusted or pirated downloads not executing unknown copied commands monitoring mshta.exe command line activity restricting or disabling MSHTA where feasible and deploying layered endpoint detection and behavior monitoring.
We audited 12K n8n templates: most have critical vulnerabilities

blog.aironclaw.com · 2 months ago

A static analysis of 12,750 n8n workflow templates found 34,880 findings including 14 critical and 6,174 high severity, and 716 workflows exposed pre authentication vulnerabilities such as server side request forgery and SQL and NoSQL injection. Six end to end attack chains were reproduced covering SSRF, SQL injection, remote code execution, prompt injection, and unauthenticated webhooks, with examples including a Telegram bot workflow that allowed shell injection and file exfiltration via crafted messages and an email CV parsing workflow that wrote attacker controlled content to the operator filesystem. About 2,488 workflows, roughly 19.5 percent of the corpus, were assessed as immediately exploitable by remote attackers, and pervasive issues included active workflows with no error handling, prompt injection in AI agents, exposed public webhooks, and hardcoded secrets.
GitHub Source Code Reportedly Compromised, TeamPCP Claims Breach

gbhackers.com · 2 months ago

A threat actor group known as TeamPCP claims it breached GitHub internal systems and exfiltrated sensitive source code and proprietary data, and is offering the alleged dataset for sale on underground forums for over fifty thousand dollars. The group says it accessed roughly four thousand private internal repositories and published partial file listings and screenshots as proof, while GitHub has acknowledged the incident, opened an investigation into unauthorized access to internal repositories, and stated it has no evidence so far that customer data outside internal repositories was affected. TeamPCP is tracked as UNC6780 by Google Threat Intelligence Group and has a history of supply chain and CI/CD abuses, including a prior compromise of the Trivy vulnerability scanner tied to CVE-2026-33634, and further updates are expected as GitHub's investigation progresses.
Grafana GitHub Breach Exposes Source Code via TanStack npm Attack

thehackernews.com · 2 months ago

An investigation found no evidence that customer production systems or the Grafana Cloud platform were compromised, and the scope of the incident is limited to Grafana Labs GitHub repositories, which included public and private source code as well as internal operational repositories and business contact names and email addresses. The breach originated from the TanStack npm supply chain attack linked to threat actor TeamPCP and was detected on May 11, 2026 after a stolen GitHub workflow token allowed attackers to download repositories despite Grafana rotating many tokens. Grafana received an extortion demand on May 16, 2026, declined to pay, and has since rotated automation tokens, implemented enhanced monitoring, audited commits for signs of malicious activity, and strengthened its GitHub security posture while reports surfaced that the attackers listed stolen materials for sale.
GitHub investigates internal repositories breach claimed by TeamPCP

www.bleepingcomputer.com · 2 months ago

GitHub is investigating unauthorized access to its internal repositories after the TeamPCP hacker group claimed to have accessed approximately four thousand private code repositories and offered them for sale. GitHub said it currently has no evidence that customer information stored outside the impacted repositories is affected and that affected customers will be alerted through established incident response channels if impact is discovered. TeamPCP posted its claim on a hacking forum demanding at least fifty thousand dollars and said it may leak the data if no buyer is found. The group has been linked to prior supply chain attacks including compromises of the Trivy vulnerability scanner and other developer platforms that led to cascading compromises and widespread malware distribution.
Veilgate - Deception proxy

veilgate.dev · 2 months ago

There is an open source deception reverse proxy called VeilGate designed to defend web targets from autonomous AI pentest agents by avoiding outright blocking and instead observing, challenging, or trapping requests. It provides three modes: observe to score each request, challenge to require proof of work, and trapit to act as a honeypot that feeds fake vulnerabilities. The project was developed because modern AI agents and readily available open source pentest tools can bypass traditional WAF blocking and probe single page applications in both blackbox and greybox assessments.
What It'll Take to Make AI BOMs Usable in a Modern Security Program

www.darkreading.com · 2 months ago

Standards and tools for AI bills of materials are maturing, but most vendors and software teams cannot yet produce AI BOMs and many security teams lack the visibility or processes to consume them. CISOs should start by scoping AI systems to map internal models, embedded AI in purchased software, and training data provenance, and then integrate AI BOM data into asset management, SIEM, and incident response workflows to quickly identify systems using a vulnerable model version. Provenance and cryptographic methods such as checksums, hashes, digital signatures, and attestation are essential because poisoned training data can backdoor models long before deployment, and agencies have recommended these integrity controls. Automating AI BOM generation in CI and CD pipelines and MLOps with cryptographic validation is critical to scale, and early research and tooling show automation can substantially reduce manual oversight while making BOMs machine readable for governance.
Microsoft disrupts malware code-signing service used by ransomware gangs

www.csoonline.com · 2 months ago

Microsoft disrupted the infrastructure behind a large malware code signing service used by ransomware affiliates, seizing the operation, revoking more than 1,000 abused code signing certificates, and taking hundreds of attacker virtual machines offline on Azure. The operation, identified as Fox Tempest, used stolen identities and impersonated organizations to obtain certificates through Azure Artifact Signing and offered malware signing as a service for fees reportedly between five thousand and nine thousand dollars. Researchers linked the service to ransomware affiliates working with gangs such as INC, Qilin, Akira, and Rhysida, and found a variant named Vanilla Tempest used signed fake installers of enterprise software including AnyDesk, Microsoft Teams, PuTTY, and Webex to deliver backdoors, infostealers, and ransomware via SEO poisoning and malvertising. Security experts warned that illicit code signing at scale undermines Windows protections such as SmartScreen by reducing or eliminating download warnings, and that signing is increasingly sold as a modular service within the cybercrime ecosystem.
Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector

www.securityweek.com · 2 months ago

Vulnerability exploitation became the most common access vector for data breaches in 2025, causing 31 percent of breaches while credential abuse accounted for 13 percent, and analysts examined about 31,000 incidents with more than 22,000 confirmed breaches. AI is accelerating the weaponization of known vulnerabilities and shrinking the window for defense from months to hours, while remediation slowed with median full patching rising to 43 days and organizations remediating only 26 percent of entries on the CISA Known Exploited Vulnerabilities catalog. Ransomware featured in 48 percent of confirmed breaches as third party involvement rose to 48 percent of breaches, 62 percent of breaches involved a human element, and widespread shadow use of generative AI and increased employee use of AI raised additional exposure.
SVD-2026-0505: Third-Party Package Updates in Splunk Enterprise - May 2026

advisory.splunk.com · 2 months ago

There are multiple vulnerabilities in third party packages used by Splunk Enterprise that have been remedied in Splunk Enterprise versions 10.2.3, 10.0.6, 9.4.11, 9.3.12 and higher. Upgrades include golang net to version 0.52.0 in the spl2-orchestrator binary, the Go compiler to go1.25.8 in the splunk-edge binary, and the expr lang library to version 1.17.8. Listed CVEs include CVE-2025-68156, CVE-2025-22872, CVE-2025-47911, CVE-2025-58190, CVE-2026-27141, CVE-2025-68121, CVE-2025-61732, CVE-2025-61731 and CVE-2025-61726.
SVD-2026-0516: Third-Party Package Updates in Splunk Add-on for Tomcat App - May 2026

advisory.splunk.com · 2 months ago

Splunk remedied multiple common vulnerabilities in third party packages used by the Splunk Add-on for Tomcat with a release dated May 20, 2026. Apache Log4j was upgraded to version 2.25.3 to address CVE-2025-68161, and Apache Commons Lang was upgraded to version 3.18.0 to address CVE-2025-48924. Operators should upgrade the Splunk Add-on for Tomcat to version 3.3.1 or higher to apply the fixes.
SVD-2026-0515: Third-Party Package Updates in Splunk User Behavior Analytics - May 2026

advisory.splunk.com · 2 months ago

Splunk remedied multiple vulnerabilities in third party packages for Splunk User Behaviour Analytics versions 5.4.5 and higher by upgrading, removing, or patching numerous components. Remediated packages include Apache Spark, jackson mapper and jackson databind, Hive, Apache Parquet Avro, idna, urllib3, requests, setuptools, OpenSSL and compat openssl, redis, postgresql JDBC, H2 Database, protobuf, kubernetes, logback core, axios, xml crypto, multer, Splunk heavy forwarder, selenium, OpenJDK, netty, lz4 java, jose4j, Python, node.js, Apache Tika, docker and containerd components, cri dockerd, underscore js, and others. Addressed CVEs include CVE-2017-15095, CVE-2017-17485, CVE-2017-7525, CVE-2017-7656, CVE-2017-7657, CVE-2017-7658, CVE-2018-11307, CVE-2018-12022, CVE-2018-12023, CVE-2018-14718, CVE-2018-14719, CVE-2018-14720, CVE-2018-14721, CVE-2018-19360, CVE-2018-19361, CVE-2018-19362, CVE-2018-5968, CVE-2018-7489, CVE-2019-0205, CVE-2019-0210, CVE-2019-10172, CVE-2019-12086, CVE-2019-14379, CVE-2019-14439, CVE-2019-14540, CVE-2019-14892, CVE-2019-14893, CVE-2019-16335, CVE-2019-16869, CVE-2019-16942, CVE-2019-16943, CVE-2019-17267, CVE-2019-17531, CVE-2019-20330, CVE-2019-20444, CVE-2019-20445, CVE-2020-10650, CVE-2020-10672, CVE-2020-10673, CVE-2020-11619, CVE-2020-11620, CVE-2020-13949, CVE-2020-14060, CVE-2020-14061, CVE-2020-14062, CVE-2020-14195, CVE-2020-24616, CVE-2020-24750, CVE-2020-25649, CVE-2020-35490, CVE-2020-35491, CVE-2020-36179, CVE-2020-36180, CVE-2020-36181, CVE-2020-36182, CVE-2020-36183, CVE-2020-36184, CVE-2020-36185, CVE-2020-36186, CVE-2020-36187, CVE-2020-36188, CVE-2020-36189, CVE-2020-36518, CVE-2020-36242, CVE-2020-8840, CVE-2020-9546, CVE-2020-9547, CVE-2020-9548, CVE-2021-20190, CVE-2021-28165, CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090, CVE-2021-37136, CVE-2021-37137, CVE-2022-25647, CVE-2022-3171, CVE-2022-3509, CVE-2022-3510, CVE-2022-3996, CVE-2022-40149, CVE-2022-40150, CVE-2022-42003, CVE-2022-42004, CVE-2022-4450, CVE-2022-45868, CVE-2022-46337, CVE-2023-0215, CVE-2023-0216, CVE-2023-0217, CVE-2023-0286, CVE-2023-0401, CVE-2023-1370, CVE-2023-22946, CVE-2023-2976, CVE-2023-34453, CVE-2023-34454, CVE-2023-34455, CVE-2023-3635, CVE-2023-39410, CVE-2023-43642, CVE-2023-44487, CVE-2023-5590, CVE-2024-12797, CVE-2024-1597, CVE-2024-21634, CVE-2024-25638, CVE-2024-29131, CVE-2024-29371, CVE-2024-29857, CVE-2024-35195, CVE-2024-36114, CVE-2024-3651, CVE-2024-37891, CVE-2024-47081, CVE-2024-47561, CVE-2024-5535, CVE-2024-55549, CVE-2025-24855, CVE-2025-27553, CVE-2025-30065, CVE-2025-4565, CVE-2025-46762, CVE-2025-47273, CVE-2025-49146, CVE-2025-49844, CVE-2025-11226, CVE-2025-58057, CVE-2025-7338, CVE-2025-66516, and CVE-2026-25639.
SVD-2026-0508: Third-Party Package Updates in Splunk AppDynamics Analytics Agent - May 2026

advisory.splunk.com · 2 months ago

Splunk remedied multiple high severity vulnerabilities in third party packages used by the Splunk AppDynamics Analytics Agent by issuing upgrades in release 26.4.0 to address the issues. Upgrades include lz4 java to 1.8.1 for CVE-2025-12183; libpng to 1.6.54 for CVE-2025-64505, CVE-2025-64506, CVE-2025-64720, CVE-2025-65018, CVE-2025-66293, CVE-2026-22695, and CVE-2026-22801; OpenJDK to 17.0.18u8 for CVE-2025-53057, CVE-2025-53066, CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, and CVE-2026-21945; elasticsearch to 8.19.9 for CVE-2025-37731, CVE-2025-68384, and CVE-2025-68390; logback core to 1.5.32 for CVE-2024-12798 and CVE-2024-12801; Netty to 4.1.132.Final for CVE-2026-33871 and CVE-2026-33870; and Jetty to 12.1.6 for CVE-2026-1605 and CVE-2025-11143. Customers should upgrade the Splunk AppDynamics Analytics Agent to version 26.4.0 or higher to receive these fixes.
SVD-2026-0512: Third-Party Package Updates in Splunk AppDynamics Private Synthetic Agent (PSA) - May 2026

advisory.splunk.com · 2 months ago

There are multiple remediations in third party packages in Splunk AppDynamics Private Synthetic Agent version 26.4.0 and higher, with upgrades and removals across packages including alpine, axios, chromium, cryptography, openssl, node.js, netty, jetty, OpenJDK, pypdf, pillow, cups, and others. The updates address a large set of CVEs including CVE-2024-27308, CVE-2024-32650, CVE-2025-11143, CVE-2025-11187, CVE-2025-11468, CVE-2025-12084, CVE-2025-13151, CVE-2025-13836, CVE-2025-14174, CVE-2025-15282, CVE-2025-1948, CVE-2025-55130, CVE-2025-55131, CVE-2025-55132, CVE-2025-58436, CVE-2025-58060, CVE-2025-59464, CVE-2025-59465, CVE-2025-59466, CVE-2025-6075, CVE-2025-62718, CVE-2025-64505, CVE-2025-64506, CVE-2025-64720, CVE-2025-66199, CVE-2025-67735, CVE-2025-68160, CVE-2025-69277, CVE-2026-0865, CVE-2026-0965, CVE-2026-0967, CVE-2026-0968, CVE-2026-1225, CVE-2026-1584, CVE-2026-1605, CVE-2026-1861, CVE-2026-21637, CVE-2026-21710, CVE-2026-21712, CVE-2026-21713, CVE-2026-21714, CVE-2026-21715, CVE-2026-21716, CVE-2026-21717, CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945, CVE-2026-22690, CVE-2026-22691, CVE-2026-22732, CVE-2026-22735, CVE-2026-22737, CVE-2026-22795, CVE-2026-22796, CVE-2026-2441, CVE-2026-24515, CVE-2026-24688, CVE-2026-25210, CVE-2026-25541, CVE-2026-25639, CVE-2026-25833, CVE-2026-25834, CVE-2026-25835, CVE-2026-25990, CVE-2026-26007, CVE-2026-2648, CVE-2026-2649, CVE-2026-2650, CVE-2026-2673, CVE-2026-27024, CVE-2026-27025, CVE-2026-27026, CVE-2026-27456, CVE-2026-27628, CVE-2026-27699, CVE-2026-28351, CVE-2026-28804, CVE-2026-3061, CVE-2026-3062, CVE-2026-3063, CVE-2026-32141, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-33055, CVE-2026-33056, CVE-2026-33870, CVE-2026-33871, CVE-2026-34073, CVE-2026-34871, CVE-2026-34872, CVE-2026-34873, CVE-2026-34874, CVE-2026-34875, CVE-2026-34876, CVE-2026-34877, CVE-2026-3536, CVE-2026-3537, CVE-2026-3538, CVE-2026-3539, CVE-2026-3540, CVE-2026-3541, CVE-2026-3542, CVE-2026-3543, CVE-2026-3544, CVE-2026-3545, CVE-2026-3731, CVE-2026-39892, CVE-2026-40175, CVE-2026-40192, CVE-2026-41324, CVE-2026-42308, CVE-2026-42309, CVE-2026-42310, and CVE-2026-42311. Users are advised to upgrade Splunk AppDynamics Private Synthetic Agent to version 26.4.0 or higher to obtain these fixes.
SVD-2026-0504: Denial of Service through coldToFrozen.sh Script in Splunk Enterprise

advisory.splunk.com · 2 months ago

A vulnerability tracked as CVE-2026-20240 allows a low-privileged Splunk user without the admin or power roles to cause a denial of service by exploiting the coldToFrozen.sh script in the splunkarchiver app to rename critical Splunk directories and render instances non functional. The issue is caused by missing input validation that permits arbitrary file paths and affects Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12 and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129. The recommended remediation is to upgrade to the listed fixed releases and, as a mitigation, disable the Splunk Archiver app if frozen bucket archiving is not required.
SVD-2026-0513: Third-Party Package Updates in Splunk AppDynamics Java Agent - May 2026

advisory.splunk.com · 2 months ago

Splunk remedied multiple vulnerabilities in third party packages used by the Splunk AppDynamics Java Agent with the release of version 26.4.0 and later. An upgrade of libarchive to version 3.5.3-9.el97 addresses CVE-2026-5121, CVE-2026-4111, and CVE-2026-4424 and is rated high severity. An upgrade of log4j-core to version 2.25.4 addresses CVE-2026-34477, CVE-2026-34478, and CVE-2026-34480 and is rated medium severity. Users should upgrade the Splunk AppDynamics Java Agent to version 26.4.0 or later.
SVD-2026-0509: Third-Party Package Updates in Splunk AppDynamics Database Agent - May 2026

advisory.splunk.com · 2 months ago

There are multiple vulnerabilities remediated in third party packages for Splunk AppDynamics Database Agent, fixed in version 26.4.0 published on May 20, 2026. Upgrades include openssl to 3.5.6 netty to 4.1.132.Final musl to 1.2.5-r23 openjdk to 17.0.18u8 log4j-core to 2.25.4 and busybox to 1.37.0-r30 to address high and low severity issues. The addressed CVEs are CVE-2025-15467 CVE-2026-28387 CVE-2025-69420 CVE-2025-69421 CVE-2026-2673 CVE-2026-28388 CVE-2026-28389 CVE-2026-28390 CVE-2026-31790 CVE-2025-69419 CVE-2025-11187 CVE-2025-15468 CVE-2025-66199 CVE-2026-31789 CVE-2026-22795 CVE-2026-22796 CVE-2025-68160 CVE-2025-69418 CVE-2026-33871 CVE-2026-33870 CVE-2026-40200 CVE-2026-6042 CVE-2026-21945 CVE-2026-21932 CVE-2026-21933 CVE-2026-21925 CVE-2026-34478 CVE-2026-34480 CVE-2026-34477 CVE-2025-46394 and CVE-2024-58251. Customers are advised to upgrade the Splunk AppDynamics Database Agent to version 26.4.0 or higher.
SVD-2026-0514: Third-Party Package Updates in Splunk AppDynamics Machine Agent - May 2026

advisory.splunk.com · 2 months ago

There are updates to Splunk AppDynamics Machine Agent in version 26.4.0 and higher that remediate multiple vulnerabilities in third party packages. Remediations include upgrades to plexus-utils to address CVE-2025-67030; apache log4j to address CVE-2026-34480, CVE-2026-34477, and CVE-2026-34478; curl to address CVE-2024-11053, CVE-2024-7264, CVE-2024-9681, and CVE-2025-14819; jetty to address CVE-2025-11143 and CVE-2026-1605; logback-core to address CVE-2026-1225; musl to address CVE-2026-40200 and CVE-2026-6042; netty to address CVE-2026-33871, CVE-2025-67735, and CVE-2026-33870; OpenJDK to address CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, and CVE-2026-21945; and OpenSSL upgrades addressing CVE-2024-13176, CVE-2024-41996, CVE-2025-11187, CVE-2025-15467, CVE-2025-15468, CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2025-9232, CVE-2026-22795, and CVE-2026-22796. Users should upgrade to version 26.4.0 or higher to apply the fixes.
SVD-2026-0510: Third-Party Package Updates in Splunk AppDynamics Cluster Agent - May 2026

advisory.splunk.com · 2 months ago

Splunk remedied multiple vulnerabilities in third party packages used by Splunk AppDynamics Cluster Agent and released the fixes in version 26.4.0 and higher. Remediated components include golang, grpc-go, openssl, spdystream, musl, curl, libarchive, gnupg, and gnutls with severities ranging from critical to medium. Specific CVEs addressed include CVE-2026-33186 for grpc-go, CVE-2026-35469 for spdystream, CVE-2025-9086 for curl, CVE-2026-4111 for libarchive, CVE-2025-68973 for gnupg, and numerous golang and openssl CVEs such as CVE-2025-61726, CVE-2026-32280, and CVE-2026-22795 among others. Users are advised to upgrade the Splunk AppDynamics Cluster Agent to version 26.4.0 or later to apply these remediations.
SVD-2026-0503: Sensitive Information Disclosure through Log Files in Splunk Enterprise

advisory.splunk.com · 2 months ago

There is a vulnerability affecting Splunk Enterprise versions earlier than 10.2.2 and 10.0.5, and Splunk Cloud Platform builds earlier than 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13 in which a user role with access to the internal index could view session cookies and response bodies that contain sensitive data. Administrators are advised to upgrade to the corrected builds to prevent exposure of session information and sensitive response data.
SVD-2026-0506: Third-Party Package Updates in Splunk Universal Forwarder - May 2026

advisory.splunk.com · 2 months ago

Splunk remedied multiple third party package vulnerabilities in Splunk Universal Forwarder impacting versions 9.4.11 and higher. The rsync package was upgraded to version 3.4.1 to address CVE-2024-12084, CVE-2024-12086, CVE-2024-12087, and CVE-2024-12088, with the issues rated multiple critical. Users are advised to upgrade to Splunk Universal Forwarder versions 10.2.3, 10.0.6, 9.4.11, 9.3.12 or later to obtain the fixes.
SVD-2026-0511: Third-Party Package Updates in Splunk AppDynamics Python Agent - May 2026

advisory.splunk.com · 2 months ago

There are multiple vulnerabilities remediated in third party packages used by the Splunk AppDynamics Python Agent, and users are urged to upgrade to version 26.4.1 or later. Updated components include alpine, OpenJDK, libpng, and log4j-core, with log4j-core upgraded from version 2.17.1 to 2.25.3 to address CVE-2025-68161. The advisory lists the following CVEs addressed: CVE-2025-15467, CVE-2025-69420, CVE-2025-69421, CVE-2025-69419, CVE-2025-11187, CVE-2025-15468, CVE-2025-66199, CVE-2026-22795, CVE-2026-22796, CVE-2025-68160, CVE-2025-69418, CVE-2026-28387, CVE-2026-2673, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31790, CVE-2026-31789, CVE-2026-40200, CVE-2026-6042, CVE-2025-46394, CVE-2024-58251, CVE-2026-27171, CVE-2026-27456, CVE-2025-50059, CVE-2025-30749, CVE-2025-50106, CVE-2025-53066, CVE-2026-21945, CVE-2026-21932, CVE-2026-21933, CVE-2025-30761, CVE-2025-53057, CVE-2025-30754, CVE-2026-21925, CVE-2026-22801, CVE-2025-64720, CVE-2025-65018, CVE-2025-66293, CVE-2026-22695, CVE-2025-64505, CVE-2025-64506, CVE-2025-28162, CVE-2025-28164. Severity ratings follow the vendors or the National Vulnerability Database and many of the listed fixes are classified as high or medium.
SVD-2026-0502: Improper Access Control through Role Inheritance in Splunk AI Toolkit app

advisory.splunk.com · 2 months ago

A vulnerability in Splunk AI Toolkit versions below 5.7.3 allows a low privileged user without the admin or power roles to access confidential data that was intended to be restricted by srchFilter role configurations. The issue stems from an authorize.conf file that injects a srchFilter entry into the built in user role and because the Splunk platform combines inherited search filters with the OR SPL operator the injected filter can override more restrictive filters on child roles. The flaw is tracked as CVE-2026-20238 and has a CVSS v3.1 score of 6.5 rated Medium. Splunk advises upgrading to Splunk AI Toolkit version 5.7.3 or higher or applying mitigations such as disabling the app or removing or emptying the srchFilter entry in authorize.conf until the patch is applied.
SVD-2026-0507: Third-Party Package Updates in Splunk AppDynamics Apache Web Server Agent - May 2026

advisory.splunk.com · 2 months ago

There are multiple vulnerabilities in third party packages used by Splunk AppDynamics Apache Web Server Agent that have been remediated in version 25.11.1. There are upgrades to expat to version 2.7.5 addressing CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, and CVE-2026-24515, to libpng to version 1.6.51 addressing CVE-2025-64720, CVE-2025-65018, CVE-2025-64505, and CVE-2025-64506, to OpenJDK to version 11.0.30u7 addressing CVE-2025-53066, CVE-2026-21945, CVE-2026-21932, CVE-2026-21933, CVE-2025-53057, and CVE-2026-21925, and to log4j-core to version 2.25.3 addressing CVE-2025-68161. Users should upgrade the Splunk AppDynamics Apache Web Server Agent to version 25.11.1 or later to obtain the fixes.
Elon Musk Loses $150 Billion Suit Against OpenAI and Sam Altman

www.nytimes.com · 2 months ago

A nine-person jury unanimously found that Elon Musk waited too long to file his lawsuit against OpenAI and its executives, ruling the claims were barred by the statute of limitations. Musk alleged that OpenAI and its leaders shifted the organization away from its nonprofit founding purpose and sought large damages, but the jury rejected the timing of his case. The verdict removes a major legal obstacle and allows OpenAI to continue raising capital and pursuing its artificial intelligence development and commercial plans.
Max-severity flaw in ChromaDB for AI apps allows server hijacking

www.bleepingcomputer.com · 2 months ago

There is a max-severity pre-authentication code injection vulnerability in the Python FastAPI server of ChromaDB that lets an unauthenticated attacker supply a malicious Hugging Face model reference with trustremotecode enabled, causing the server to download and execute the model and enabling remote code execution and server takeover. CVE-2026-45829 was introduced in ChromaDB 1.0.0, remained unpatched in version 1.5.8, and was disclosed to the NVD with a published entry on May 18, 2026. Researchers report roughly 73 percent of internet-exposed instances run vulnerable versions and recommend using the Rust frontend, avoiding exposing the Python API, restricting network access to the ChromaDB port, and scanning or avoiding models that require trustremotecode as immediate mitigations.