Blahalla

Cisco RoomOS Stack Overflow Vulnerability

sec.cloudapps.cisco.com · 2 months ago

A vulnerability in the Cisco RoomOS USB driver (CVE-2026-20302) allows an unauthenticated local attacker physical access to execute arbitrary code with root privileges. Insufficient boundary checks enable an exploit using a malicious USB device, potentially causing a buffer overflow condition. Cisco strongly recommends upgrading to fixed software releases to remediate this vulnerability.

Cisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability

sec.cloudapps.cisco.com · 2 months ago

A vulnerability (CVE-2026-20177) in Cisco IE 1000 Series Switches allows unauthenticated, remote attackers to cause a denial of service. Attackers exploit the flaw by sending a high rate of ICMP, SSH, or HTTP traffic to the device. Successful attacks disrupt device manager, SSH, or API functionality, requiring users to apply fixed software updates for remediation.

Cisco Unified Intelligence Center SQL Injection Vulnerability

sec.cloudapps.cisco.com · 2 months ago

A vulnerability exists in the web-based management interface of Cisco Unified Intelligence Center, allowing authenticated, local attackers to perform a blind SQL injection attack. The flaw stems from insufficient validation of user-supplied input. Exploiting this vulnerability (CVE-2026-20327) enables an attacker to read the internal database contents of the affected device.

Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Server-Side Request Forgery Vulnerability

sec.cloudapps.cisco.com · 2 months ago

Cisco disclosed an SSRF vulnerability (CVE-2026-20314) affecting Cisco Packaged and Cisco Unified Contact Center Enterprise. Improper input validation in specific HTTP requests allows an authenticated, remote attacker to execute arbitrary network requests. Cisco advises customers to apply available software updates to fully remediate this vulnerability.

Cisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 2 months ago

Cisco disclosed CVE-2026-20232, a stored XSS in Cisco IE 1000 Series Switches' web interface. An authenticated, remote attacker can inject code via poor input validation, executing arbitrary scripts. Customers must upgrade firmware to patch this vulnerability.

Cisco Secure Workload Software Security Hardening Release: August 2026

sec.cloudapps.cisco.com · 2 months ago

The Cisco Secure Workload engineering team issued hardening releases for Cisco Secure Workload Software after an internal security review. These updates fix critical vulnerabilities, including CVE-2026-20231 (command injection) and CVE-2026-20315 (improper access control). The advisory also covers CVE-2026-20317, CVE-2026-20318, and CVE-2026-20319, affecting both SaaS and on-premises deployments.

US charges Iranian hackers over $3.4 billion intellectual property theft

www.bleepingcomputer.com · 2 months ago

The U.S. charged 17 Iranians, linked to the Mabna Institute, for years of state-sponsored IP theft. These hackers allegedly stole 31.5 terabytes of academic data, valued at $3.4 billion, impacting numerous universities and private firms. The Department of Justice alleges this operation began around 2013 and compromised the accounts of over 100,000 global professors.

I escaped the WebAssembly's sandbox and got arbitrary shell execution on the host.

trustsig.eu · 2 months ago

The vulnerability exists in wasm2c, the tool that compiles WebAssembly modules into C for sandboxed execution. Researchers showed that the table allocator utilizes an unchecked calloc, allowing an attacker to declare a table size that causes allocation failure. The runtime fails to check the NULL return value, potentially enabling a sandbox escape (Issue 2831).

Some Stand-Up Comics Are Pivoting Away From Video on Social Media

www.nytimes.com · 2 months ago

Comedians used to post footage of their performances to build a following. Now, some are finding that comic strip-style panels with captions pack a bigger punch.

Former Ping Identity and CyberArk Executives Join AppViewX to Scale Machine and Agent Identity Security

gbhackers.com · 2 months ago

AppViewX hired Mike Durso as Chief Revenue Officer and named Clarence Hinton to its Board of Directors. Durso joins the company, bringing two decades of experience from Ping Identity and CyberArk, to drive global sales efforts. These leadership additions solidify AppViewX’s focus on securing machine identities, AI agents, and the cryptographic infrastructure supporting the quantum enterprise.

Before-and-after images show where SpaceX rocket crashed into the moon

www.washingtonpost.com · 2 months ago

NASA released images of a new lunar crater after a SpaceX Falcon 9 upper stage crashed into the moon on August 5. The rocket component struck the surface at about 5,400 mph following over a year in space. NASA affirmed that impacting the lunar surface constitutes an accepted and safe method for disposing of hardware.

Voters Aren’t Waiting for November to Try Ousting Officials Over Data Centers

www.nytimes.com · 2 months ago

Local officials who backed large data centers now face growing public backlash. Citizens are organizing recall elections against these supporting officials. This situation underscores public concern over the environmental and infrastructural impacts of massive computing sites.

How One County Profited From Data Centers Amid a Growing National Backlash

www.nytimes.com · 2 months ago

Loudoun County, Virginia, profited from hosting over 250 data centers, enabling the county to reduce property taxes. This financial model attracts attention from neighboring communities. However, the national proliferation of data centers faces increasing public backlash.

Password spraying attacks surge 155x as hackers exploit MFA gaps

www.bleepingcomputer.com · 2 months ago

Huntress observed a 155x spike in password spraying attacks during the first half of 2026. These campaigns, which generated over 81 million login attempts, successfully targeted Azure CLI and exploited gaps in multi-factor authentication policies. Attackers leveraged the Resource Owner Password Credentials (ROPC) grant, bypassing modern MFA safeguards with reused credentials.

China Wants Its Tech Champions to Raise Money at Home

www.nytimes.com · 2 months ago

The market debuts of two technology companies signal Beijing's strategic shift in funding sources. This move targets local investors to finance ambitious artificial intelligence goals. Consequently, China reduces its reliance on major global financial markets like Wall Street.

China-Nexus Hackers Target Myanmar Diplomats With QUICAgent Go Backdoor via Malicious VHD Files

gbhackers.com · 2 months ago

A China-nexus group targets Myanmar diplomats with QUICAgent, a custom Go-based backdoor. The campaign delivers the implant using malicious VHD files, disguising them as benign images or fake department invitations. Victims initiate infection by opening a decoy LNK file, which utilizes trusted utilities like ftp.exe to execute the payload.

ValleyRAT campaign uses fake GSTR-3B overdue notice targeting Indian taxpayers

blog.himanshuanand.com · 2 months ago

Silver Fox hit Indian taxpayers with fake "GSTR-3B overdue" lures. The attack used a signed executable to inject DLLs into RuntimeBroker.exe, deploying ValleyRAT malware with a UACMe kit and process killer. Three C2 endpoints were found.

SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs

thehackernews.com · 2 months ago

A cyber espionage operation named SilkParasite targets government bodies across Central Asia. Investigators observed this intrusion utilizing seven remote access tool families. Five of these RATs, DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT, represent previously undocumented malware families.

CRLF-Powered Desync Attacks: Beheading HTTP Streams

portswigger.net · 2 months ago

HTTP Header Injection risks are severe. Researchers detailed desync worm creation using connection-locked desyncs to exploit XSS and steal HTTPOnly cookies. Attackers can also use request smuggling against CDNs.

CISA Warns Microsoft Internet Key Exchange RCE Flaw Is Actively Exploited

gbhackers.com · 2 months ago

CISA added CVE-2026-33824, a critical double-free vulnerability, to its Known Exploited Vulnerabilities Catalog. This flaw affects Microsoft Internet Key Exchange (IKE) Service Extensions, compromising VPN connectivity. Remote attackers can exploit the vulnerability to execute arbitrary code, necessitating immediate patching for exposed systems.

Google Mandiant AI Agents Find Over 100 Critical Vulnerabilities in Source Code Within Two Days

gbhackers.com · 2 months ago

Google's AVDH found over 100 critical vulnerabilities in stolen code using LLM agents for profiling, threat modeling, and enrichment. It assigned 12 CVEs, including CVE-2026-13242 and CVE-2026-55803. The tool rapidly identifies code entry points.

How to break secure boot without touching any cryptography

0x434b.dev · 2 months ago

RoT uses ROM/OTP fuses. Secure Boot authorizes state. Measured Boot records it. Remote Attestation lets verifiers confirm policy adherence via signed evidence.

Prevalent AI Raises $22 Million to Expand Data Fabric Platform

www.securityweek.com · 2 months ago

Prevalent AI raised $22 million to scale its data fabric platform. The company developed a solution that converts fragmented enterprise data into a comprehensive knowledge graph. This platform helps security teams and AI agents gain context and identify operational gaps to securely deploy AI systems.

Windows 11 24H2 Home and Pro Support Ends in October 2026

gbhackers.com · 2 months ago

Microsoft warns that Windows 11 24H2 Home and Pro lose security updates on October 13, 2026, requiring users to upgrade to Windows 11 25H2. This date also ends servicing for Windows 10 Enterprise LTSB 2016. Organizations must plan migrations; however, Enterprise versions remain supported until October 2027.

Balonx PhaaS Steals Bank OTPs in Real Time While AI Calls and Android RAT Target Victims

gbhackers.com · 2 months ago

Balonx, a PhaaS service, targets Mexico's banks using Android malware, real-time OTP theft, and AI vishing. It uses a WebSocket for live session observation, enabling man-in-the-middle attacks to steal credentials for fraud.

Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P

thehackernews.com · 2 months ago

Cybersecurity researchers at Hunt.io disclosed "Operation CameraSwarm," a campaign that compromised over 14,530 Dahua devices between June 17 and July 22, 2026. Attackers exploited credential attacks and two authentication-bypass flaws, using a peer-to-peer relay technique to execute the breach. Researchers reconstructed the campaign using a 407 MB exposed working directory containing 2,616 files.

US Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of Them

www.securityweek.com · 2 months ago

The US charged 17 members of the Mabna Institute, an Iran-based group acting on behalf of the IRGC, for hacking hundreds of institutions. The defendants stole over 31 terabytes of academic data and compromised accounts at universities across the US and internationally. Authorities offered up to $10 million in rewards for the arrest of five key defendants involved in the cyberattacks.

Phishing 3.0: The Fight Moves to Agent Versus Agent

thehackernews.com · 2 months ago

Traditional email defenses, designed to scan for malicious payloads like links or attachments, are becoming ineffective. Modern phishing campaigns shift focus from the message content to its true intent. These attacks escalate by using AI and automated, non-human senders, challenging existing security protocols.

StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data

thehackernews.com · 2 months ago

Cybersecurity researchers flagged a global cybercrime operation exploiting thousands of hacked WordPress websites. This infrastructure helps the group disseminate malware, commandeer infected hosts, and store stolen documents, screenshots, and activity logs. The operation employs a comprehensive toolkit of criminal software, rather than depending on a single piece of malware.

Microsoft fixes known issue causing Windows Defender crashes

www.bleepingcomputer.com · 2 months ago

Microsoft resolved a bug causing Windows Defender to crash, which resulted in 0xc0000005 access violation errors on some affected systems. Users must apply the latest security intelligence update (version 1.457.236.0 or later) via Windows Update to implement the fix. The company advises enabling automatic updates to ensure protection against malware and viruses.

Snowflake flaw slips past AI checks, gets exploited by another AI

www.csoonline.com · 2 months ago

Red Agent found a critical command injection in Snowflake's GitHub Actions via jiraissue.yml. Attackers could run commands via issue titles, bypassing PR-only protections. Wiz reported the flaw.

Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign

www.securityweek.com · 2 months ago

Cl0p exploited CVE-2026-12569 in PTC Windchill/FlexPLM via improper input validation, achieving RCE. They used web shells/implants to steal data from 40+ victims, including Shell, Philips, and Fiserv.

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

thehackernews.com · 2 months ago

CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday. These shortcomings include CVE-2026-65400, an improper authentication flaw impacting Apple macOS. The agency warns these vulnerabilities are actively exploited in the wild.

ICE Collecting DNA Samples

www.schneier.com · 2 months ago

ICE collected nearly a million DNA samples last year.

CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities

www.securityweek.com · 2 months ago

The flaws can be exploited for remote code execution, authentication bypass, and device takeover.

659 Stripe Merchant API Keys Leaked Online, Exposing 688,000 Customer Records

gbhackers.com · 2 months ago

A data leak published on a cybercrime data-trading forum has exposed live Stripe API credentials for 659 merchant accounts, along with approximately 35 GB of customer- and payment-related data. The exposure affects an estimated 688,363 customer records across merchants in 42 countries, but available evidence indicates that Stripe’s own infrastructure was not breached.

Cursor 0-Day Lets Attackers Execute Malicious Code by Opening a Repository

gbhackers.com · 2 months ago

A recently disclosed security issue in Cursor IDE exposed a serious Windows binary-planting vulnerability that could allow malicious code to execute simply by opening an untrusted repository.

Critical RCE flaw in Windows IKE Extension now actively exploited

www.bleepingcomputer.com · 2 months ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity remote code execution (RCE) flaw in the Windows Internet Key Exchange (IKE) Service Extensions component.

BeyondTrust Endpoint Privilege Management Flaws Enable Local Privilege Escalation

gbhackers.com · 2 months ago

BeyondTrust has revealed two high-severity vulnerabilities in its Endpoint Privilege Management (EPM) Windows Deployment product, which could lead to local privilege escalation and bypasses of anti-tamper protections on affected devices. These vulnerabilities are tracked as CVE-2026-40144 and CVE-2026-40145 and affect all versions of Endpoint Privilege Management for Windows before version 26.1.2.

We found cops who misused Flock. Their police departments didn’t know.

www.washingtonpost.com · 2 months ago

Police departments have powerful tools to track how officers use Flock’s license-plate cameras. But across the country, agencies often don’t perform oversight, leaving potential abuse to be uncovered by journalists, activists and victims.

Oracle Releases 943 Security Patches to Fix Critical Vulnerabilities Across Enterprise Products

gbhackers.com · 2 months ago

Oracle has released 943 security patches as part of its August 2026 Critical Security Patch Update (CSPU), addressing newly disclosed vulnerabilities across its enterprise software portfolio. This update affects Oracle products under both Premier Support and Extended Support. It includes fixes for flaws tracked by various CVE identifiers.

Ransom Busters Ransomware Affiliate Targets Victims With Fake Data Recovery Extortion

gbhackers.com · 2 months ago

A threat actor calling itself “Ransom Busters” is targeting ransomware victims with a deceptive recovery offer, claiming it can restore encrypted files and delete stolen data from ransomware infrastructure.

943 Patches Rolled Out With Oracle’s August 2026 Security Update

www.securityweek.com · 2 months ago

The fixes resolve over 1,000 vulnerabilities across two dozen products, including over 460 remotely exploitable bugs.

Windows 11 24H2 Home and Pro reach end of support in 2 months

www.bleepingcomputer.com · 2 months ago

Microsoft has reminded customers that systems running Home and Pro editions of Windows 11 24H2 will stop receiving updates in two months.

Most organizations aren’t ready for a Hugging Face-level event

www.csoonline.com · 2 months ago

The National Security Agency (NSA) and Central Security Service recently published an advisory statement on behalf of the Five Eyes Cyber Security Agencies, warning that AI technologies are making it easier than ever for would-be malicious actors to infiltrate and compromise sensitive networks. “AI is not a future consideration, it is already here,” the statement says.

AI triggers a wave of anxiety among the world’s greatest math minds

www.washingtonpost.com · 2 months ago

Top mathematicians gathered recently in San Francisco at the offices of OpenAI to discuss what would be left for humans to do when artificial intelligence becomes superhuman at math.

CISOs are struggling to threat-model AI. Can 15-minute sessions help?

www.csoonline.com · 2 months ago

A few weeks ago, on a busy day, threat-modeling expert Adam Shostack opened an email from a client. Someone at that organization had vibe-coded an app and put it to work with customer data. Now, the client wanted to know what risks the tool posed. And what it should do about them. They needed answers quickly, so Shostack gave himself 15 minutes to analyze the system.

Chrome, Firefox Updates Patch Dozens of Vulnerabilities

www.securityweek.com · 2 months ago

The bugs could lead to code execution, privilege escalation, sandbox escape, and information disclosure.

Microsoft Links 30+ Domains to MacSync Stealer’s Credential-Theft and Data-Exfiltration Infrastructure

gbhackers.com · 2 months ago

More than 30 domains tied to MacSync Stealer, exposing a rotating macOS-focused infrastructure that supports payload delivery, command-and-control, credential theft, staging, and chunked data exfiltration. The investigation shows why defenders should prioritize repeatable endpoint and network behavior over static domain-based detections.

CISA: Medusa ransomware hit over 500 critical infrastructure orgs

www.bleepingcomputer.com · 2 months ago

The FBI said Tuesday that the Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021.