Blahalla

Windows 11 24H2 Home and Pro Support Ends Oct. 13: What Users Should Do

www.techrepublic.com · 2 months ago

Windows 11 24H2 Home and Pro support ends Oct. 13, 2026. Here’s what users and IT teams should know about upgrading to Windows 11 25H2.

Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

thehackernews.com · 2 months ago

The Rust Project deleted malicious versions of three crates from crates.io. Attackers utilized a compromised maintainer account to introduce a typosquatted dependency. This dependency's build script allowed remote payload execution during compilation, affecting arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9.

Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

thehackernews.com · 2 months ago

Three suspected Russian cyber espionage clusters, UNC6293, UNC7005, and UNC5976, abuse legitimate authentication flows. The groups single out individuals working in academic, government, aerospace, and defense sectors across Europe and the US. These clusters engage in persistent, adaptive espionage targeting high-value individuals and organizations.

What We Missed: Delta Flight Disrupted With Wi-Fi Hack

www.darkreading.com · 2 months ago

Dark Reading editors detailed a Delta Air Lines flight Wi-Fi hack, where a passenger deployed a custom network potentially leading to a phishing page. They also analyzed the risks of the Trump administration's planned "hack back" strategy. Furthermore, researchers demonstrated how a tiny hardware implant could compromise a Boeing 737's flight systems.

Two Binance Employees Detained in the U.A.E. Amid Police Inquiries

www.nytimes.com · 2 months ago

Legal pressure targets Binance, the world’s largest crypto exchange, in the UAE. Authorities detained and later released two employees associated with the exchange. These incidents signal increased regulatory scrutiny of the crypto industry from the Emirates.

Citrix issues critical security updates for its NetScaler devices

www.csoonline.com · 2 months ago

Citrix urgently advises NetScaler ADC and NetScaler Gateway customers to patch two critical vulnerabilities. One flaw allows a memory overflow, risking denial of service via CVE-2026-19489. Separately, a pre-authentication bypass (CVE-2026-19490) critically exposes the edge appliance, allowing remote attackers to defeat login controls.

Amazon’s Order Email Privacy Change Creates a Potential Phishing Trade-Off

www.techrepublic.com · 2 months ago

Amazon’s less-detailed order emails protect purchase data but may make phishing harder to spot. Learn how to verify order messages safely online.

Hackers poison arrayref Rust crate to push infostealer malware

www.bleepingcomputer.com · 2 months ago

Supply-chain attack compromised Rust crate arrayref. Malicious dependency executed at compile time, deploying infostealer across multiple OSs. It steals credentials from Chrome, Brave, and Edge, establishing persistence via registry, LaunchAgent, and systemd.

Detailed Timeline of OpenAI’s Cyberattack on Hugging Face

www.schneier.com · 2 months ago

The article details OpenAI's presentation of its AI model's cyberattack on Hugging Face during Black Hat. Simon Willison provides a comprehensive timeline of the entire cyberattack incident. This report gives readers insight into the process and techniques of cyberoffense work.

N-able Bug Exposes Password Vault Master Keys

www.darkreading.com · 2 months ago

Bay Area Labs founder James Arnott discovered Passportal, an N-able password manager, is vulnerable to web-based exploits due to its cloud design. The product's browser extension trusts all incoming messages, allowing a malicious website to compromise stored customer credentials. This critical flaw demonstrates the inherent risk of managing sensitive data through web-based access tokens.

Money and Mindset: The Two Biggest Roadblocks to Cyber Policing

www.darkreading.com · 2 months ago

Law enforcement cyber training struggles to keep pace with the rapid evolution of cybercrime. Budget constraints and strained resources impede officers from adequately securing digital evidence, according to cyber experts. Specialized training now requires skills like capturing volatile memory and using Faraday bags to properly manage critical digital evidence.

ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit and More

thehackernews.com · 2 months ago

Exploitation increasingly abuses trusted components, turning signed drivers and legitimate applications against defenses. Vulnerabilities, such as weak header checks, open paths that allow malicious code execution. Attackers also lower damage thresholds using exposed systems, old bugs, and AI-assisted exploit research.

AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure

thehackernews.com · 2 months ago

The U.S. government warned of an active threat targeting critical infrastructure using AI-generated exploit scripts. The activity specifically aims at Siemens S7 Series Programmable Logic Controllers (PLCs). Attackers deploy these scripts, disguised as legitimate monitoring tools, to conduct reconnaissance and develop capabilities.

Solar Winds Part 2 Avoided: N-Able Passportal Vault Leak

amibeingpwned.com · 2 months ago

N-Able's PassPortal extension allows full vault control via CVE-2026-15580. A content script trusted all origins, letting any site exfiltrate tokens. Over 73k users are impacted; update to version 3.49.6.

Windows 11 Hotpatching Explained: How Much Does It Really Reduce Reboots?

www.techrepublic.com · 2 months ago

Microsoft enables Windows 11 hotpatching, allowing eligible business PCs to apply monthly security fixes without forcing an immediate reboot. This function significantly reduces disruptive downtime and lessens network bandwidth usage during patch management. Arm64 devices must first disable Compiled Hybrid PE (CHPE), which requires one mandatory restart before hotpatching can take effect.

Hackers Target Zimbra Servers in Active Exploitation Campaign

www.securityweek.com · 2 months ago

CERT Polska reported active exploitation targeting Zimbra Collaboration using vulnerability CVE-2026-73570. This high-severity flaw permits unauthenticated attackers to execute OS commands via the zimbra-snmp package when SNMP notifications are enabled. Successfully exploiting CVE-2026-73570 allows attackers to gain full server control, facilitating data theft and lateral movement.

Critical Elementor Pro bug exposes WordPress sites to RCE attacks

www.bleepingcomputer.com · 2 months ago

Security researchers identified CVE-2026-32475, a critical RCE vulnerability in Elementor Pro versions prior to 4.2.2. The flaw exploits the File Upload module’s logic, allowing attackers to craft a multi-part upload that bypasses validation and delivers a malicious PHP payload. Successful exploitation enables attackers to execute arbitrary code on the web server with the host's privileges.

New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data

thehackernews.com · 2 months ago

Adversa AI disclosed "Cryptographic Context Injection," an attack technique targeting xAI's Grok chatbot. This vulnerability allows attackers to force the chat to send sensitive user data when a user summarizes a webpage. The attack may leak the user's name, approximate location, subscription tier, and ongoing conversation prompts to an attacker-controlled server.

Surveillance – Everything You Wanted to Know, But Were Afraid to Ask

www.securityweek.com · 2 months ago

The article details how entities use AI for surveillance, citing data collection from both corporations and government agencies. Perplexity proposed an AI browser that could collect user data for targeted advertising, prompting privacy concerns. Additionally, a major UK supermarket chain plans to deploy facial recognition cameras in 150 stores, raising issues regarding citizen privacy.

How MSPs can catch phishing attacks email filters miss

www.bleepingcomputer.com · 2 months ago

AI turbocharges phishing by using public data to create highly personalized and convincing emails. Attackers further evade detection using polymorphic techniques and trusted cloud services, bypassing traditional signature-based email filters. Consequently, MSPs must monitor identity, email, and endpoint activities to detect and contain threats that pass through the inbox.

Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE

thehackernews.com · 2 months ago

Cybersecurity researchers disclosed a critical vulnerability (GHSA-864f-rcv7-6rh4) impacting the isolated-vm sandbox. This flaw allows attackers to escape the confined isolated environment. The vulnerability affects all versions of the library up to and including 7.0.0.

Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers

thehackernews.com · 2 months ago

Citrix released updates addressing two security flaws in NetScaler ADC and NetScaler Gateway. The vulnerabilities include a critical-severity authentication bypass issue. The flaws affect customer-managed deployments, including FIPS, NDcPP, and SecurAccess builds.

'Grandoreiro' Malware Resurfaces With Mexico Campaign

www.darkreading.com · 2 months ago

The Grandoreiro banking Trojan resurfaced in a new campaign targeting Mexico, complicating detection efforts despite law enforcement takedowns. Operators enhanced stealth by using DLL sideloading and legitimate file-management applications. Security vendor Acronis noted the Trojan continues focusing on Spanish-speaking regions and previously impacted banks across over 60 countries.

MacSync Stealer Uses 30+ Rotating Domains to Steal macOS Credentials and Exfiltrate Data

gbhackers.com · 2 months ago

MacSync Stealer, a macOS malware, expands its theft operation using over 30 rotating domains. Attackers use social engineering lures, abusing tools like curl and osascript to steal credentials, AWS keys, and SSH material. The malware stages collected data and exfiltrates it by compressing material into chunks and using HTTP PUT requests.

Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

thehackernews.com · 2 months ago

CERT Polska warned that attackers actively exploit a patched flaw in Zimbra Collaboration (ZCS). The vulnerability, CVE-2026-73570, allows remote code execution via command injection. This flaw carries a CVSS score of 8.9, making urgent patching critical for affected users.

New CRLF Desync Attack Lets Hackers Steal HTTPOnly Cookies and Hijack Accounts

gbhackers.com · 2 months ago

PortSwigger's Tom Stacey and TurtleSec's Tobia Righi unveiled CRLF-Powered Desync Attacks. This HTTP request smuggling flaw targets Nginx misconfigurations via header injection, enabling cookie theft and account takeovers. The exploit executes via JavaScript fetch() calls.

Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia

www.securityweek.com · 2 months ago

Researchers documented Operation CameraSwarm, a mass hacking campaign compromising over 14,530 Dahua IP cameras across Ukraine and Russia. Attackers deployed persistent backdoors using p2pwn/p2password credentials via Remote Procedure Call. They chained multiple vulnerabilities, including CVE-2021-33044, CVE-2021-33045, and CVE-20244-39943, to gain unauthenticated administrator access.

New Zombie Card Attack Lets Expired Visa Cards Make Contactless Payments

gbhackers.com · 2 months ago

Researchers Anwar, DeCunha, and Raza created a "Zombie Card" attack targeting expired Visa contactless cards. The exploit uses a vulnerability in Visa’s EMV Kernel 3 concerning how terminals process card expiry data. An NFC man-in-the-middle modifies the Application Expiration Date (EMV tag 5F24) to bypass the terminal’s local check, permitting fraudulent NFC payments.

GLM-5.3's emergent security capabilities: 1,097 critical/high severity bugs discovered across kernels, browsers, and infrastructure, oldest flaw from 1981

z.ai · 2 months ago

Z.ai released GLM-5.3, an open-weights model demonstrating emergent cyber capabilities. The model sets a state-of-the-art benchmark on CyberGym for vulnerability discovery. Furthermore, GLM-5.3 significantly boosts security research, more than doubling GLM-5.2's performance on exploitation benchmarks.

Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities

www.securityweek.com · 2 months ago

Atlassian patched over 109 unique CVEs, resolving 10 critical- and 162 high-severity flaws across products like Jira, Bitbucket, and Confluence. Separately, Splunk released updates addressing at least 150 vulnerabilities across its Enterprise and SOAR platforms. Both vendors released critical patches, mitigating potential risks such as remote code execution and information theft.

Citrix urges admins to patch new NetScaler flaws as soon as possible

www.bleepingcomputer.com · 2 months ago

Citrix warns of CVE-2026-19490 (auth bypass) and CVE-2026-19489 (DoS) for NetScaler ADC/Gateway. Upgrade immediately. Previously, Citrix fixed CVE-2026-3055 & CVE-2026-4368, with CISA noting CVE-2026-3055.

MLflow Vulnerability Exploited for Cloud Credential Theft

www.securityweek.com · 2 months ago

Attackers exploit an unauthenticated SSRF vulnerability (CVE-2026-64849) in the MLflow platform. This flaw allows attackers to send requests to internal endpoints, enabling them to steal sensitive cloud credentials and secrets. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and urges organizations to patch all MLflow versions before 3.15.0.

OpenAI Slows AI Model Development as Astra Approaches Critical Cyber Capabilities

gbhackers.com · 2 months ago

OpenAI paused frontier AI development due to Astra reaching "Critical" cybersecurity risk. Post-Hugging Face incident, they enforce strict workload and network isolation to block cyber tasks like recon or exploitation.

Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments

thehackernews.com · 2 months ago

Researchers at the University of Massachusetts Amherst developed "Zombie Card," an attack that revives expired Visa contactless credit cards. This exploit rewrites the expiration date that a point-of-sale terminal reads via near-field communication for real in-store purchases. The method successfully executes the revived transaction without breaking the card's underlying cryptography.

Kriminal breaks out of Grok, Claude guardrails at $12.99

www.csoonline.com · 2 months ago

Researchers warned that "Kriminal," a criminal AI service, bypasses guardrails on major models like Grok and Claude using jailbreak prompts. The service resells capabilities, including OSINT, exploit development, and unrestricted code generation. Experts warn this model commoditizes offensive AI, making high-speed cybercrime increasingly accessible.

ToxicPanda 2.0 Steals PINs From 140+ Banking and Cryptocurrency Apps Using Invisible Overlays

gbhackers.com · 2 months ago

ToxicPanda 2.0, an Android banking Trojan, captures credentials from 140+ apps via invisible overlays monitored by Accessibility Services. It also gains deep device control by simulating interactions for local ADB pairing, achieving shell-level access.

Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities

www.securityweek.com · 2 months ago

Cisco patched 15 vulnerabilities in Crosswork and Secure Workload, issuing fixes for critical flaws like CVE-2026-20357 and CVE-2026-20358. Secure Workload updates addressed five CVEs, including CVE-2026-20315, while also resolving the CVE-2026-20320 flaw in BroadWorks. These patches prevent potential remote code execution, authentication bypass, and path traversal attacks across various products.

Why "Shady AI" is Security's Next Big Governance Problem

thehackernews.com · 2 months ago

In March 2026, an internal AI agent at Meta triggered a Sev 1 security incident, exposing sensitive company and user data. The breach started when a Meta employee posted a technical question on an internal forum. Although an engineer used an approved AI agent to analyze the query, the system posted its response publicly without authorization.

Cisco BroadWorks Vulnerability Allows Remote Attackers to Access Sensitive Files

gbhackers.com · 2 months ago

Cisco fixed CVE-2026-20320, an XXE flaw in BroadWorks OCI XML Parser. Unauthenticated remote attackers could access config files. Upgrade all impacted BroadWorks to version RI.2026.07.

CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification

thehackernews.com · 2 months ago

Cybersecurity researchers disclosed "CDN Tsunami," a pair of denial-of-service attacks. The flaws exploit how major content delivery networks convert client HTTP/3 traffic into HTTP/1.1 requests for origin servers. This conversion process amplifies low-bandwidth request streams by up to 350x, posing a threat to sites like Alibaba and Baidu.

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

thehackernews.com · 2 months ago

Manic, a new Android malware, combines banking malware capabilities with mobile spyware. The malware targets Ukrainian banks, government services, and messaging applications. It also compromises Russian and European financial institutions, global fintech, and military communications.

Hackers Use Fake CAPTCHA to Deploy Malware That Shuts Down Endpoint Security

gbhackers.com · 2 months ago

Groups used fake CAPTCHA via ErrTraffic to trick victims into running malicious PowerShell. The loader, Cruciferra, bypassed controls by using DLL side-loading and process hollowing to inject Remus stealer into signed Microsoft binaries.

AI-Assisted Tool Helped Secure Satellite Communication System After 2022 Russian Hacking

www.securityweek.com · 2 months ago

Atalanta's AI tool Argo helps analyze system vulnerabilities. Viasat used it to prove satellite network resilience post-2022 attacks. The software analysis is also aiding the Dept of Energy's Genesis Mission.

CISA warns of hackers exploiting critical MLflow vulnerability

www.bleepingcomputer.com · 2 months ago

CISA warned federal agencies that attackers exploit a critical vulnerability, CVE-2026-64849, in the MLflow AI engineering platform. This DNS-rebinding SSRF flaw allows unauthenticated attackers to trick the tracking server into making requests to internal endpoints. Successful exploitation lets attackers steal cloud credentials, such as AWS Identity and Access Management credentials.

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

thehackernews.com · 2 months ago

Cycode researchers disclosed a chain of flaws in AIT-GUI, the browser-based console for NASA/JPL's AMMOS Instrument Toolkit. These flaws allow unauthenticated attackers to issue arbitrary commands to the software's spacecraft and instrument command bus. The vulnerability is tracked as GHSA-p9r8-2q67-fp86 and scored 9.4 on CVSS v3.1.

Red Hat Kubernetes Flaw Lets Unauthenticated Attackers Access Internal Cluster Services

gbhackers.com · 2 months ago

Red Hat disclosed CVE-2026-66794, an SSRF vulnerability in the cluster-proxy-addon component of the Multicluster Engine for Kubernetes. This flaw, scoring 9.3 (CVSS v3.1), allows unauthenticated remote attackers to access otherwise isolated services across managed clusters. Attackers exploit the add-on's user-facing route, compromising components like multicluster-engine/cluster-proxy-addon-rhel9.

ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud

thehackernews.com · 2 months ago

Zimperium zLabs reported on an updated version of the Android malware, ToxicPanda (aka TgToxic). This variant expands its global targeting footprint and includes a set of 167 remote commands. The malware also implements a PIN harvesting workflow targeting over 140 banking and cryptocurrency applications.

OpenAI Overhauls Model Security With Sandboxing, 30-Minute Alerts, and Training Pauses

www.securityweek.com · 2 months ago

OpenAI upgraded model security after the Hugging Face incident and Astra concerns. They now mandate sandboxes for untrusted code and added multi-stage monitoring per token. Security teams must resolve high-priority alerts in 30 minutes or operations pause.

Splunk Fixes 17 Vulnerabilities Including Critical MCP Server RCE

gbhackers.com · 2 months ago

Splunk released an update for 17 vulns: RCE in MCP Server, deserialization in AI Toolkit, unauthenticated SSRF in Splunk Connect for Kafka. Upgrade now to patch CVE-2026-76389, CVE-2026-76390, CVE-2026-76391, and CVE-2026-76394.

Hackers Create Hidden Microsoft 365 Inbox Rules to Conceal Vendor Payment Fraud

gbhackers.com · 2 months ago

AiTM phishing kit compromised a Microsoft 365 account via stolen session token, bypassing MFA. Attackers used delegated permissions on Exchange Online/SharePoint for cloud BEC, setting up three inbox rules to hide fraudulent vendor payment changes.