Blahalla

Microsoft confirms patching issues in restricted Windows networks

www.bleepingcomputer.com · 2 months ago

Customers in restricted network environments may encounter Windows Update failures after installing the January 2026 optional non security preview updates, with affected systems showing error code 0x80010002 when updating through Windows Update. The issue stems from recent changes to download timeout requirements that prevent downloads initiated from the Windows Update Settings page but do not affect device integrity or the ability to install updates obtained by other means. While a fix is in progress, administrators can deploy Known Issue Rollback group policies KB5083806 for Windows 11 26H1 or KB5083631 for Windows 11 24H2, 25H2 and Windows Server 2025 and must restart devices to apply the setting.
Pathfinding Labs: Deploy, test, and learn from 100+ intentionally vulnerable AWS environments

securitylabs.datadoghq.com · 2 months ago

On May 18, 2026 Datadog Security Labs introduced Pathfinding Labs a collection of more than one hundred intentionally vulnerable AWS environments that can be deployed into sandbox accounts to practice privilege escalation multi hop and cross account attacks and to exercise Cloud Security Posture Management detections. The project pairs a web catalog with capture the flag style hints and full exploitation solutions with Terraform based deployable labs and a Go command line tool called plabs that automates enabling applying exploiting and destroying labs without requiring direct Terraform interaction. Each lab includes a demo attack script that verifies the misconfiguration and reproduces known attack paths so teams can validate detection tooling and measure graph based reconstructions of attack paths. Users are advised to run labs only in isolated sandbox accounts with billing alerts and to destroy resources when finished and a hosted version that would let users complete labs without deploying to their own AWS accounts is planned.
macOS Malware Abuses Fake Google Update for Persistence

gbhackers.com · 2 months ago

A newly observed variant of the SHub macOS infostealer, dubbed Reaper, is expanding capabilities with stealthier delivery, enhanced data theft, and a persistence mechanism disguised as a Google software update. Reaper uses typo squatted lure sites and leverages the applescript URL scheme to open Script Editor with a padded malicious script that displays a fake XProtect update while silently decoding and executing a remote shell script, and the lures perform extensive fingerprinting and anti analysis checks before delivering the payload. It harvests macOS credentials and Keychain entries, targets many browsers, messaging apps and cryptocurrency wallets, includes a filegrabber that stages and splits archives for exfiltration, and tampers with wallet application files to install trojanized binaries. Persistence is achieved by dropping a fake GoogleUpdate binary under the Google Application Support path and registering a LaunchAgent that checks a command and control server every minute, and defenders are advised to monitor unexpected Script Editor activity, suspicious outbound connections, creation of LaunchAgents in trusted vendor namespaces, and unauthorized wallet file modifications.
Operation Ramz Dismantles 53 Servers Used in Scam and Malware Campaigns

gbhackers.com · 2 months ago

A large scale international operation led by INTERPOL resulted in 201 arrests and the dismantling of 53 malicious servers used to host phishing pages, manage botnets, and facilitate malware and financial scam campaigns across the Middle East and North Africa. Dubbed Operation Ramz, the initiative ran from October 2025 to February 2026, involved law enforcement from 13 countries and the sharing of nearly 8,000 intelligence reports that helped identify 382 additional suspects and confirm 3,867 victims. Private sector partners including Group IB, Kaspersky, Shadowserver Foundation, Team Cymru and Trend Micro supported tracking and takedown efforts, and authorities reported links between cybercrime operations and human trafficking where individuals were coerced into scam activity after being lured with fake job offers.
CVE-2026-34473: Pre-auth ZTE H-series router DoS via CGILua request-body parsing

minanagehsalalma.github.io · 2 months ago

An unauthenticated denial of service affects ZTE H series routers when oversized URL encoded POST bodies are parsed before login, causing the web management interface to become unavailable and tracked as CVE-2026-34473. The root cause is a pre authentication architectural flaw in the CGILua request body handling where POST data under the configured maxinput budget is fully read and parsed, specifically via the x www form urlencoded parsing path. The original 2024 disclosure estimated exposure at over 140,000 devices across 17 or more models, ZTE acknowledged the report in May 2024 and later told researchers in February 2026 that the issue had been resolved on March 23, 2021, while MITRE assigned CVE-2026-34473 in March 2026 and published it in May 2026; related CVE identifiers mentioned are CVE-2026-34472, CVE-2026-34474, CVE-2026-8508, and CVE-2026-6837.
Microsoft Edge Enhances Security by Preventing Password Loading at Startup

gbhackers.com · 2 months ago

Microsoft is rolling out a change to Edge to stop saved passwords from being loaded into memory at startup after a Norwegian security researcher found the browser was decrypting and keeping stored passwords in cleartext in process memory during launch. With local access and sufficient privileges, an attacker or piece of malware could dump process memory and recover those passwords, so Edge will now decrypt credentials only when needed, for example during autofill or when a user interacts with the password manager. The fix is live in the Canary channel and will be included in Edge build 148 and newer across Stable, Beta, Dev, Canary and the Extended Stable enterprise channel, and it will be delivered automatically through regular browser updates.
Laurie Anderson Is Quoting Me

www.schneier.com · 2 months ago

Laurie Anderson includes in a track and in interviews a paraphrase of a cryptologist warning that believing technology will solve problems shows a misunderstanding of both the problems and the technology. The line originates with Roger Needham's comment about cryptography and was adapted by Bruce Schneier in the preface to his 2000 book Secrets and Lies. Schneier says he should have credited Needham, that he later shortened the phrasing, and that Anderson has been reciting the line in performances for years.
ShinyHunters Takes Responsibility for Attack on Learning Management Platform

gbhackers.com · 2 months ago

ShinyHunters has claimed responsibility for a cyberattack that disrupted a widely used learning management system, temporarily denying access to online educational services for schools and universities across the United States. An FBI public service announcement dated May 15, 2026, Alert I-051526-PSA, states the platform has been restored but warns the incident may have exposed sensitive user and institutional data and could enable follow-on attacks. The group is known for extortion tactics including direct threats, harassment, publication of stolen data on dark web leak sites, and using harvested information to enable identity theft and highly targeted spearphishing. The FBI urges victims not to pay extortion demands, to verify suspicious communications through official channels, to report incidents to the Internet Crime Complaint Center, and to preserve relevant evidence.
Drupal to Release Urgent Core Security Updates on May 20, Sites Told to Prepare

thehackernews.com · 2 months ago

Drupal will release a core security update for all supported branches on May 20, 2026, during a maintenance window from 5 to 9 p.m. UTC. Site operators are urged to reserve time to apply updates immediately because exploits may be developed within hours or days, and patches are expected for supported branches 11.3.x, 11.2.x, 10.6.x and 10.5.x while manual patch files may be provided for some end-of-life minor versions. Administrators are advised to update to the latest patch releases now and to meet the listed minimum interim versions such as 11.1.9 and 10.4.9 so they can apply the security release as soon as it is published; Drupal 7 is not affected.
201 Arrested in Crackdown on Cybercrime in Middle East, North Africa

www.securityweek.com · 2 months ago

There were 201 arrests and 382 additional suspects identified in a law enforcement crackdown on phishing and malware in the Middle East and North Africa. Operation Ramz, a 13 country effort running from October 2025 to February 28, 2026, led to the seizure of 53 servers and the identification of 3,867 victims. Participating countries included Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the United Arab Emirates, with private partners such as Group IB, Kaspersky, the Shadowserver Foundation, Team Cymru, and TrendAI assisting investigators. Investigations uncovered a phishing as a service site, cases of human trafficking used to recruit scam workers, compromised devices spreading malware, and servers infected and affected by multiple critical vulnerabilities.
What to Look for When Choosing an ASPM Platform

gbhackers.com · 2 months ago

Application security posture management is now a foundational capability for SaaS and software companies as engineering velocity and AI-generated code increase, prompting security teams to unify visibility and prioritize risk across code, cloud, and runtime. Evaluators are focusing on capabilities such as AI-generated code detection, unified code-to-cloud visibility, and vulnerability correlation that reduces noise by deduplicating findings and prioritizing by exploitability. Platforms are also judged on integration with static analysis, software composition analysis and dynamic testing, runtime intelligence to distinguish real exposure, secrets detection tied into developer workflows, automation for remediation and compliance reporting, and software supply chain governance. Leading vendor capabilities highlighted map to AI code protection, cloud attack path analysis, change-based risk context, enterprise testing coverage, runtime workload visibility, developer-aligned secrets detection, workflow automation, and repository-level supply chain defenses.
Gentlemen Ransomware Targets Windows, Linux, NAS, BSD, and ESXi Systems

gbhackers.com · 2 months ago

There is a ransomware operation called The Gentlemen that emerged publicly in late 2025 and rapidly scaled in 2026, targeting Windows, Linux, NAS, BSD and VMware ESXi environments. The group operates as ransomware as a service with affiliates, uses a Go based payload that requires a password parameter, deploys ransom notes named README GENTLEMEN dot TXT and appends extensions such as dot seven m t z h h or other randomized variants while performing reconnaissance, privilege escalation, disabling security and backup services, and exfiltrating data for double extortion. By May 2026 the leak site listed 352 claimed victims though incident response data indicates related activity in over fifteen hundred environments, with the highest impact in professional services, manufacturing, technology and healthcare and geographic concentration across APAC, Europe and the Americas led by the United States. Organizations are advised to secure remote access, enforce multifactor authentication, monitor privileged and administrative accounts, maintain resilient isolated backups, and hunt for early attacker behaviors such as unusual administrative activity, lateral movement and data staging.
PoC Released for DirtyDecrypt Linux Kernel Vulnerability

www.securityweek.com · 2 months ago

Proof of concept code is now available for a Linux kernel vulnerability called DirtyDecrypt also known as DirtyCBC that allows local attackers to elevate privileges to root. The defect is a missing copy on write guard in the rxgkdecryptskb component of the RxGK subsystem and was patched in April for mainline Linux builds. Distributions with CONFIGRXGK enabled such as Arch Linux Fedora and openSUSE are affected and while the V12 team has not assigned a CVE researchers point to CVE-2026-31635 as the likely identifier and note related kernel flaws including CVE-2026-46300.
RCE and arbitrary file write in Vitess vtbackup via untrusted MANIFEST fields

neurowinter.com · 2 months ago

Two vulnerabilities have been disclosed in Vitess vtbackup that trust fields in backup MANIFEST files, allowing remote code execution and arbitrary file write during restore. CVE-2026-27965 enables command execution as the vitess user by running the ExternalDecompressor field through a shell, it is rated CVSS 8.4 and tied to CWE 78, and a quick workaround is to set the external decompressor flag to a harmless command such as cat to override the manifest. CVE-2026-27969 is a path traversal in FileEntries Name that permits writing files anywhere the vitess user can write, it is rated CVSS 9.3 and tied to CWE 22 and has no flag-based workaround. Affected releases include version 22.0.3 and older and 23.0.0 through 23.0.2, and fixes are available in versions 22.0.4 and 23.0.3.
SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access

thehackernews.com · 2 months ago

Critical security vulnerabilities were disclosed in SEPPMail Secure E-Mail Gateway that could enable unauthenticated attackers to achieve remote code execution and read arbitrary mail from the virtual appliance. Identified flaws include CVE-2026-2743 with a CVSS score of 10.0 enabling path traversal and arbitrary file write, CVE-2026-7864, CVE-2026-44125, CVE-2026-44126, CVE-2026-44127, CVE-2026-44128, and CVE-2026-44129 covering information leakage, missing authorization, deserialization of untrusted data, attachment preview path traversal, eval injection, and template injection that can lead to remote code execution. A demonstrated attack path shows overwriting the syslog configuration to obtain a Perl reverse shell and fully take over the appliance to read all mail traffic and persist, and vendor updates have addressed some issues in versions 15.0.2.1, 15.0.3 and 15.0.4 with an earlier fix for CVE-2026-27441.
Kimsuky Uses LNK, JSE Lures to Target Recruiters, Crypto Users, Defense Officials

gbhackers.com · 2 months ago

North Korea linked threat group Kimsuky launched at least four spear phishing campaigns in early 2026 targeting recruiters, cryptocurrency users, developers, defense personnel, and academic administrators. The campaigns used oversized LNK files disguised as PDFs and JSE scripts masked as Hangul documents to display decoy documents while extracting hidden payloads, establishing persistence with scheduled tasks and fileless PowerShell, and abusing built in tools such as certutil and rundll32. Attackers hosted payloads on trusted developer services and abused remote tunneling features to blend malicious traffic with legitimate activity, and tailored payloads using victim identifiers such as UID, IP address, or MAC address to evade sandboxing. Defenders are advised to focus on behavior based detection, monitor for executions of large LNK files and hidden PowerShell activity, review scheduled tasks and process relationships, restrict execution of untrusted scripts and LNK files, and monitor outbound connections to developer platforms and tunneling services.
20-Year-Old PostgreSQL Flaw Gets Public PoC Exploit for Remote Code Execution

gbhackers.com · 2 months ago

A newly released proof of concept exploit for CVE-2026-2005 exposes a critical vulnerability in PostgreSQL's pgcrypto extension that can enable remote code execution. The flaw is rooted in legacy code paths dating back nearly twenty years and can be exploited to escalate privileges and run arbitrary commands on affected systems. Security researchers warn that administrators should apply available fixes or mitigations promptly and investigate exposed servers for signs of compromise.
7 tips for accelerating cyber incident recovery

www.csoonline.com · 2 months ago

There are seven tips for accelerating cyber incident recovery, emphasizing well trained and coordinated incident response teams, rapid scoping and containment, and clear situational awareness. Key technical steps include eradication, preserving forensic evidence, restoring systems from validated clean backups or golden images, validating and testing before reconnecting, and heightened post-recovery monitoring to detect re-entry. Organizations should enlist external DFIR and recovery specialists when needed, prioritize restoration by business criticality rather than convenience, follow structured frameworks such as NIST 800-61 and RACI to avoid improvisation, and implement lessons learned before running validation tests. Experts warn that AI driven attacks accelerate adversary actions, extended outages increase risk of re compromise and data integrity issues, and prolonged recovery efforts strain staff and compliance.
Four-Faith Industrial Routers Targeted in Botnet Hijacking Campaign

gbhackers.com · 2 months ago

Four-Faith industrial cellular routers are being actively targeted in a growing botnet campaign exploiting a critical authentication bypass vulnerability tracked as CVE-2024-9643. Security researchers warn that attackers are rapidly weaponizing the flaw to hijack exposed devices and repurpose them as part of large scale malicious infrastructure. The vulnerability affects Four-Faith F3x36 industrial routers.
PostgreSQL Flaws Expose Databases to Remote Code Execution and SQL Injection

gbhackers.com · 2 months ago

Critical PostgreSQL updates 18.4, 17.10, 16.14, 15.18, and 14.23 address 11 security flaws and more than 60 bugs in versions 14 through 18 that could allow remote code execution, SQL injection, and denial of service. The tracked vulnerabilities include CVE-2026-6472, CVE-2026-6473, CVE-2026-6474, CVE-2026-6475, CVE-2026-6476, CVE-2026-6477, CVE-2026-6478, CVE-2026-6479, CVE-2026-6575, CVE-2026-6637, and CVE-2026-6638, covering issues such as missing authorization, integer wraparound out of bounds writes, format string memory leaks, symlink overwrites, SQL injection in replication, client memory overwrite, MD5 timing attacks, SSL recursion denial of service, buffer over read, refint stack overflow potentially leading to remote code execution, and SQL injection in refresh publication. Operators are urged to upgrade to the patched releases, stop using MD5 authentication in favor of SCRAM SHA 256, restrict replication privileges, audit extensions such as refint, and monitor for abnormal queries or crashes.
Hackers Exploit Entra ID Accounts to Steal Microsoft 365, Azure Data

gbhackers.com · 2 months ago

A sophisticated campaign by the threat actor tracked as Storm-2949 abused Microsoft Entra ID accounts through social engineering that tricked users into approving multifactor authentication prompts and exploited the self service password reset process to gain persistent access. After gaining privileged access, attackers exfiltrated Microsoft 365 data from OneDrive and SharePoint, targeted sensitive documents such as VPN configurations, and leveraged role based access control to move into Azure App Services, Key Vaults, Storage accounts, and SQL databases. The attackers modified Azure configurations to facilitate large scale data theft by changing Key Vault access policies to extract secrets, retrieving storage account keys and SAS tokens, altering SQL firewall rules, creating administrator accounts on virtual machines via VMAccess, and deploying remote access tools while attempting to disable defenses and clear logs. Detection relied on correlating identity, cloud, and endpoint signals and recommended hardening MFA processes, enforcing least privilege for RBAC, auditing Key Vault and Microsoft Graph activity, and enabling cross domain detection.
Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer

thehackernews.com · 2 months ago

A compromised version of the Nx Console extension rwl.angular-console version 18.95.0 was published to the Visual Studio Code Marketplace, affecting a plugin with more than 2.2 million installations and silently fetching a 498 kilobyte obfuscated payload from a dangling orphan commit in the nrwl nx GitHub repository. The payload functions as a multi stage credential stealer and supply chain poisoning tool that exfiltrates secrets via HTTPS the GitHub API and DNS tunneling installs a Python backdoor on macOS using the GitHub Search API as a dead drop and harvests secrets from 1Password Anthropic Claude Code npm GitHub and AWS while avoiding machines in Russian and CIS time zones. Attackers abused a developer whose GitHub credentials were compromised to push the unsigned commit and the payload includes Sigstore integration that combined with stolen npm OIDC tokens could allow publishing malicious npm packages with valid provenance; users exposed between May 18 2026 2 36 p.m. CEST and 2 47 p.m. CEST are urged to update to version 18.100.0 or later check for listed indicators of compromise terminate malicious processes remove artifacts and rotate all reachable tokens keys and credentials.
JavaScript Malware Campaign Drops Crypto Clipper via PowerShell

gbhackers.com · 2 months ago

A large scale CountLoader campaign uses layered obfuscation and a multi stage infection chain combining a malicious executable, a PowerShell one liner, an obfuscated JavaScript loader executed via mshta, and in memory shellcode injection to deploy a cryptocurrency clipper. The malware disables AMSI, establishes persistence through scheduled tasks, spreads via removable media by replacing legitimate files with malicious shortcuts, and communicates with encrypted command and control using a custom protocol that mixes a randomly generated six digit key with XOR operations and Base64 encoding. Researchers sinkholed a backup C2 domain, observed about five thousand infected systems connecting per minute and roughly eighty six thousand unique infected machines worldwide with the highest counts in India, Indonesia, and the United States, and warn that the final payload continuously monitors and replaces copied cryptocurrency wallet addresses to hijack transactions.
Compromised GitHub Action Steals Workflow Credentials

gbhackers.com · 2 months ago

A widely used GitHub Action named actions-cool/issues-helper was compromised by reassigning all release tags to an imposter commit identified as 1c9e803, and a second repository actions-cool/maintain-one-comment was similarly hijacked. The malicious payload executed in GitHub Actions runners downloads the bun JavaScript runtime, spawns subprocesses including python3, escalates privileges to access runner memory, reads the Runner.Worker process memory to extract secrets marked isSecret true, and then transmits the stolen credentials to an attacker controlled domain. Recommended mitigations include pinning actions to immutable commit SHAs, auditing and replacing tag based action references, monitoring for unexpected processes and outbound network connections, and deploying imposter commit detection and network block lists to prevent exfiltration.
Critical Vulnerability Exposes Industrial Robot Fleets to Hacking

www.securityweek.com · 2 months ago

A critical operating system command injection vulnerability, CVE-2026-8153, affects Universal Robots PolyScope 5 and allows an unauthenticated attacker with network access to send commands to the Dashboard Server that are executed on the robot's operating system, resulting in remote code execution. The flaw is rated critical with a CVSS score of 9.8 and has been patched in PolyScope version 5.25.1, but remote exploitation requires the Dashboard Server to be enabled and its port to be reachable, a condition made more likely by flat, unsegmented networks or control boxes connected via Ethernet. Successful exploitation could allow takeover of individual collaborative robots, create safety hazards to humans, and escalate to compromise of entire fleets and connected industrial equipment through legacy field protocols.
Mini Shai-Hulud Attack Hits @antv npm Packages

gbhackers.com · 2 months ago

A large scale npm supply chain attack compromised multiple widely used packages in the antv ecosystem by taking over the maintainer account atool, impacting libraries such as echarts for react, g2, g6, x6, l7, g2plot and other packages including timeago js, size sensor, and canvas nest js. Researchers detected rapid malicious publishing with 639 malicious package versions observed in one hour on May 19 and more than 1,000 compromised versions across npm, PyPI, and Composer in the broader campaign. The malicious packages add a heavily obfuscated root index file executed via preinstall scripts to harvest credentials including GitHub tokens, npm tokens, cloud keys, Kubernetes secrets, SSH private keys and database connection strings, then encrypt stolen data using AES 256 GCM and exfiltrate it to a command and control endpoint or by uploading files to GitHub. The payload can validate stolen npm credentials to modify and republish packages under compromised identities, enabling worm like self propagation and posing significant downstream risk for projects that automatically install dependency updates.
CISA Admin Reportedly Exposes AWS GovCloud Credentials in Public GitHub Repository

gbhackers.com · 2 months ago

A contractor-maintained public GitHub repository named Private-CISA exposed administrative AWS GovCloud access keys, plaintext usernames and passwords, internal tokens, and credentials for CISA development infrastructure, with researchers disclosing the exposure on May 15, 2026. The repository, created November 13, 2025, showed disabled secret scanning and poor repository hygiene, and some of the exposed AWS credentials were reportedly still valid and granted high-level access when tested. Keys reportedly remained active for up to 48 hours after removal, raising concerns about lateral movement, supply chain injection, and privilege escalation, and CISA says it is investigating with no evidence to date of systems compromise.
Microsoft to Retire Teams Together Mode to Improve Performance

gbhackers.com · 2 months ago

Microsoft will retire the Together mode feature in Microsoft Teams effective June 30, 2026. Product Manager Katarina Tranker confirmed on the Microsoft 365 Insider blog that Teams will shift to simplified meeting layouts designed to improve performance, usability, and consistency across devices. The change is intended to streamline meeting experiences and prioritize cross device performance improvements.
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials

thehackernews.com · 2 months ago

Threat actors compromised the popular GitHub Actions workflow actions-cool/issues-helper and moved every existing tag to point to an imposter commit that injects malicious code to harvest CI and CD credentials and exfiltrate them to an attacker-controlled server. The imposter commit downloads the Bun JavaScript runtime, reads memory from the GitHub Actions Runner.Worker process to extract secrets, and makes outbound HTTPS calls to an attacker-controlled domain to transmit the stolen data. Fifteen tags for a second action, actions-cool/maintain-one-comment, were also poisoned, GitHub has disabled access to the repository, and the exfiltration domain was observed in the Mini Shai-Hulud campaign, suggesting the activity may be related. Workflows that reference these actions by tag are at risk on their next run, while workflows pinned to a known-good full commit SHA are unaffected.
SEPPmail Gateway Flaws Expose Organizations to RCE and Email Traffic Interception

gbhackers.com · 2 months ago

There are multiple critical vulnerabilities in the SEPPmail Secure E Mail Gateway that can lead to remote code execution and interception of sensitive email traffic, putting widely deployed appliances at risk especially in the DACH region. The flaws include CVE 2026 2743 which allows pre authenticated remote code execution via arbitrary file write in the Large File Transfer feature, CVE 2026 7864 for sensitive information exposure through an unauthenticated debug endpoint, CVE 2026 44127 for local file inclusion to read arbitrary files, and CVE 2026 44128 for unauthenticated remote code execution via Perl code injection in the GINA v2 interface. Demonstrations show attacks chaining path traversal in file uploads to overwrite system logging configuration and trigger a reverse shell, and injecting Perl into the GINA interface to execute commands, resulting in full gateway compromise, email decryption, credential access, and persistent backdoors. Organizations are advised to upgrade to patched versions 15.0.2.1 15.0.3 or 15.0.4 or later, disable unused features such as LFT and GINA v2, restrict external access to management and API endpoints, and monitor logs for unusual file writes or API activity.
Mythos Preview Automates PoC Exploit Creation for Vulnerability Research

gbhackers.com · 2 months ago

The Mythos Preview model from Anthropic, evaluated by Cloudflare under Project Glasswing, can automatically construct working proof of concept exploits by chaining multiple low severity bugs into a single high severity attack chain. There are two key capabilities: exploit chain construction that reasons about combining attack primitives such as use after free and return oriented programming into multi stage exploits, and automated proof generation where the model writes exploit code, compiles and runs it in a sandbox, reads output, and iterates until successful. Cloudflare observed the model operated without standard safety restrictions in the research environment and produced inconsistent organic refusals, warning that these emergent guardrails are not sufficient and that public releases will require externally enforced safeguards. While the capability can reduce speculative findings and speed triage when paired with a working PoC, the same automation could accelerate offensive operations, and Cloudflare said all discoveries in the project were triaged and remediated under its vulnerability management process.
Compromised Nx Console VS Code Extension Steals Developer and Cloud Secrets

gbhackers.com · 2 months ago

A malicious build of the Nx Console VS Code extension nrwl.angular-console v18.95.0 was published to the Visual Studio Code Marketplace on May 18, 2026 and, while live for roughly eleven minutes, executed a hidden task that fetched a 498 kilobyte obfuscated payload from an orphan commit, immediately risking widespread compromise due to auto‑updates and frequent installs. The payload is a multi‑stage credential stealer and supply chain poisoning toolkit that hunts for secrets across GitHub, npm, AWS, HashiCorp Vault, Kubernetes, 1Password, filesystem and memory, integrates with Sigstore to produce forged provenance for signed npm packages, and explicitly targets AI coding assistant credentials stored by Claude Code. It daemonizes for persistence, exfiltrates harvested secrets via encrypted HTTPS, GitHub API abuse and DNS tunneling, and on macOS drops a Python backdoor that registers a LaunchAgent to poll GitHub using signed commit messages as a dead‑drop command and control channel. Anyone who installed v18.95.0 should assume full compromise and immediately remove the extension, rotate exposed tokens and keys, audit npm publishing logs for suspicious signed releases, and hunt for the macOS LaunchAgent and dropped backdoor while tightening token governance and monitoring for anomalous Sigstore and OIDC activity.
Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account

thehackernews.com · 2 months ago

Cybersecurity researchers have uncovered a software supply chain attack that used a compromised npm maintainer account named atool to push trojanized versions to hundreds of packages in the AntV ecosystem and related projects, including the echarts for react wrapper which sees about 1.1 million weekly downloads. The attacker published 639 malicious versions across 323 unique packages, including 558 versions across 279 AntV packages, embedding a stealer that harvests more than 20 credential types such as cloud provider keys, GitHub and npm tokens, SSH keys and database connection strings, and that attempts Docker container escape before compressing, encrypting and exfiltrating the data. The campaign employs automated npm propagation that validates stolen tokens, downloads package tarballs, injects payloads and preinstall hooks, increments versions and republishes under the compromised identity, and security firms link the tradecraft to the Mini Shai Hulud campaign and a financially motivated actor called TeamPCP whose open sourced framework has spawned copycat packages and further spread.
SIEM-Kaufratgeber

www.csoonline.com · 2 months ago

Die kontextuellen Daten, die SIEM-Lösungen liefern, sind eine grundlegende Komponente moderner Security-Stacks. PeopleImages.com, Yuri A | shutterstock.com Protokoll-Daten zu auditieren, zu überprüfen und zu managen, ist alles andere als eine glamouröse Aufgabe, aber ein entscheidender Aspekt, um ein sicheres Unternehmensnetzwerk aufzubauen. Schließlich schaffen Event Logs oft eine sekundäre Angriffsfläche für Cyberkriminelle, die damit ihre Aktivitäten verschleiern wollen. Vorgängen wie diesen treten Netzwerksicherheitsexperten mit Tools aus dem Bereich Security Information and Event Management (SIEM) entgegen: Diese Werkzeuge bieten im Regelfall einen zusätzlichen Schutzschirm für Logs, indem sie sie auf einen Server oder Service auslagern und so verhindern, dass sie manipuliert oder gelöscht werden. In diesem Ratgeber lesen Sie: welche Kriterien bei SIEM-Tools wichtig sind, was bei diesen Lösungen mit Blick auf die Kosten zu beachten ist, und welche SIEM-Anbieter und -Lösungen führend sind. Das richtige SIEM-Tool auswählen Eine passende SIEM-Lösung auszuwählen, ist essenziell, um geschäftskritische Systeme und Dienste zu überwachen. Aber auch, um: Daten für Authentifizierungszwecke bereitzustellen, die Threat Detection zu unterstützen, und SOAR -Plattformen Kontext zu liefern. Die folgenden Bereiche, beziehungsweise Kriterien, sollten Sie mit Blick auf SIEM-Angebote unbedingt vor einem Kauf durchdenken. Betriebsmodell Um Funktionen schneller zu iterieren und hinzuzufügen, steht das Gros moderner SIEM-Lösungen inzwischen in einem Software-as-a-Service ( SaaS )-Modell zur Verfügung. Die unendliche Kapazität der Cloud erleichtert es den Anbietern dabei auch, Machine-Learning ( ML )-Funktionen zu integrieren, die Referenzdaten in rauen Mengen benötigen, um Anomalien erkennen zu können. Es besteht grundsätzlich Einigkeit darüber, dass der SaaS-Ansatz dazu beigetragen hat, SIEM-Lösungen voranzubringen. Dennoch sind einige Unternehmen darauf angewiesen, SIEM-Tools On-Premises zu betreiben. In der Regel, weil sie Compliance-Vorschriften einhalten und in diesem Zuge Protokolle (und die damit zusammenhängenden Daten) in ihrer lokalen Infrastruktur vorhalten müssen. Deshalb gibt es immer noch einige SIEM-Optionen für den Einsatz vor Ort, darunter auch solide Open-Source -Lösungen. Analytics Eine SIEM-Lösung ist nur so gut wie die Informationen, die sie liefert: Log- und Event-Daten aus der Infrastruktur zu sammeln, ist nutzlos, wenn es nicht dazu beiträgt, Probleme zu erkennen und informierte(re) Entscheidungen zu treffen. Deswegen setzen moderne SIEM-Systeme auf Machine Learning, um Anomalien in Echtzeit zu erkennen und ein präzises Frühwarnsystem für potenzielle Angriffe sowie Anwendungs- und Netzwerkfehler zu etablieren. Wie Ihre spezifischen Anforderungen an die Analysefähigkeiten einer SIEM-Lösung aussehen, hängt von mehreren Faktoren ab: Welche Systeme sollen überwacht werden? Welche Skills stehen in der Organisation mit Blick auf Dashboards, Reportings und Untersuchungen zur Verfügung? Haben Sie bereits in eine Analytics-Plattform investiert und möchten diese integrieren? Die Antworten auf diese Fragen können Sie dabei unterstützen, SIEM-Optionen einzugrenzen. Sollten Sie weder auf entsprechende Skills, noch Lösungen zurückgreifen können, empfiehlt sich möglicherweise eine SIEM-Lösung mit einer umfangreichen Dashboard-Bibliothek, beziehungsweise ein Managed Service. Protokolle Wie ein SIEM-System Daten verarbeitet, ist ein weiterer, wichtiger Aspekt mit Praxisbezug. Häufig extrahieren Software-Agenten Protokoll- und Ereignisdaten von Servern und Workstations, während Netzwerkhardware und Cloud-Anwendungen sie über eine Integration oder eine API direkt an das SIEM „übergeben“ können. Eine grundlegende Frage ist in diesem Zusammenhang, ob das SIEM auch wichtige, externe Event-Informationen akkurat identifizieren kann. Im Idealfall sollte das SIEM ausgereift genug sein, um Event-Daten aus den gängigsten Systemen zu parsen und dabei so genau sein, dass keine Anpassungen erforderlich sind und wichtige Details wie Event-Levels oder betroffene Systeme herausgefiltert werden. Um zu vermeiden, dass Log-Einträge nicht korrekt geparst werden, empfiehlt sich zudem eine Lösung, die flexible Möglichkeiten bietet, Event-Daten zu verarbeiten, nachdem sie erfasst wurden. Warnmeldungen Ein wesentlicher Vorteil moderner SIEM-Lösungen ist die Möglichkeit, Systeme in Echtzeit zu überwachen. Allerdings ist das Feature überflüssig, wenn das SIEM selbst, beziehungsweise seine Alerts, nicht von einem menschlichen Experten ausgewertet werden. Mit Blick auf die Warnmeldungen und Benachrichtigungen besteht die Herausforderung vor allem darin, beim Volumen der Alerts Maß zu halten: Zu viele Warnmeldungen werden von den Benutzern entweder deaktiviert oder ignoriert. Zu wenige Alerts bergen die Gefahr, dass kritische Bedrohungen unter den Tisch fallen. Auch mit Blick auf dieses Kriterium empfehlen sich flexible SIEM-Lösungen, die es ermöglichen, Alerts zu konfigurieren, zum Beispiel über Regeln, Schwellenwerte oder verschiedene Warnmethoden (SMS, E-Mail, Push-Nachrichten und Webhooks). Rollenbasierter Zugriff Rollenbasierte Zugriffskontrollen sind für große, weltweit tätige Unternehmen mit unterschiedlichen Business-Segmenten und Applikationsteams unerlässlich. Dabei ist es nicht bloß ein Komfort-Feature, Admins, Entwickler und Datenanalysten nur Zugriff auf die Event-Logs zu gewähren, die sie benötigen. Vielmehr entspricht das dem Least-Privilege-Prinzip, das in einigen Branchen auch regulatorisch durchgesetzt wird. Den Zugriff der Benutzer auf SIEM-Event-Daten beschränken zu können, begrenzt zudem den Impact kompromittierter Konten und trägt letztlich zum Schutz des gesamten Netzwerks bei. Schließlich bieten Event-Daten oft tiefe und detailreiche Einblicke in Applikations- und Service-Funktionalitäten, oder gar die Netzwerkkonfigurationen von Devices. Diese Informationen könnten Cyberkriminelle nutzen, um Systeme auszuspähen und zu infiltrieren. Compliance Diverse, regulatorische Rahmenwerke, beispielsweise die DSGVO oder HIPAA, setzen nicht nur voraus, dass SIEM- oder ähnliche Systeme eingesetzt werden, sondern schreiben teilweise auch vor, wie die Lösung konfiguriert sein sollte. Sie sollten sich deshalb mit den für Ihre Organisation relevanten Anforderungen im Detail vertraut machen. Dabei können unter anderem relevant sein: Aufbewahrungsfristen, Verschlüsselungsanforderungen, digitale Signaturen und Berichtspflichten. Dabei sollten auch mögliche Audit-Elemente nicht unberücksichtigt bleiben: Die SIEM-Lösung Ihrer Wahl sollte die erforderlichen Dokumentationen und Reportings ausgeben können, die die Auditoren zufriedenstellen. Event-Korrelation Die Möglichkeit, Protokolle aus unterschiedlichen (und/oder integrierten) Systemen in einer einzigen Ansicht zu korrelieren, ist ebenfalls ein guter Grund dafür, ein SIEM-System zu implementieren. Dieses sollte in der Lage sein, Log-Events von jeder Anwendungskomponente (Datenbank, Applikationsserver) zu verarbeiten (selbst wenn sie auf mehrere Hosts verteilt sind), und diese in einem Data Stream zu korrelieren. Das macht nachvollziehbar, wie die Events der Komponenten miteinander zusammenhängen. In vielen Fällen können korrelierte Ereignisprotokolle eingesetzt werden, um ( Privilege-Escalation -)Angriffe zu erkennen und ihren Impact über die verschiedenen Netzwerksegmente hinweg zu tracken. Das wird auch deswegen immer wichtiger, weil Unternehmen zunehmend auf die Cloud oder Container-basierte Infrastrukturen setzen. Ökosysteme Ein SIEM mit einem robusten, ausgereiften Ökosystem ermöglicht es, verschiedene Funktionen zu verbessern, beziehungsweise zu erweitern. Wenn das SIEM direkt (oder über Plugins) in andere Systeme integriert werden kann, erleichtert das die Arbeit erheblich. Neben den Systemverbesserungen, die durch ein SIEM-Ökosystem erzielt werden können, gibt es noch weitere Business Benefits. So kann eine moderne, ausgereifte SIEM-Lösung: die Nachfrage nach Schulungen steigern, Support auf Community-Basis fördern, und den Einstellungsprozess vereinheitlichen. API-Interaktion Ein Ökosystem wird nicht allen Anforderungen gerecht: Falls Ihr Unternehmen Software entwickelt oder in DevOps-Initiativen investiert hat, kann die Möglichkeit, programmgesteuert mit einer SIEM-Lösung zu interagieren, einen wesentlichen Unterschied machen. Statt wertvolle Entwicklungszeit in Logging-Funktion zu stecken, kann das SIEM-System Ereignisdaten aus benutzerdefiniertem Code aufnehmen, korrelieren und analysieren. Künstliche Intelligenz (KI) SIEM scheint ein maßgeschneiderter Anwendungsfall für KI-gestützte Analysen, entsprechend scheuen sich die Anbieter nicht, entsprechende Funktionen in ihre Lösungen zu implementieren. Die fokussieren sich im Allgemeinen auf die Bereiche Analytics und Alerts. KI-fähige SIEM-Systeme können mit Cloud-Daten-Feeds einer Vielzahl von Anbietern und Quellen integriert werden. Das ermöglicht, Event-Daten automatisiert mit Kontext auszustatten und dafür zu nutzen, um: Ereignisse zu bewerten, Angriffsketten zu identifizieren und Incident-Response-Pläne zu erstellen. Mit Blick auf KI-fähige SIEM-Lösungen kann auch das Thema Betriebsmodell eine Rolle spielen: Einige On-Premises-Angebote erfordern unter Umständen, KI-Workloads an Cloud-Services auszulagern. SIEM-Kosten Wenn es um Security Information and Event Management geht, sollten Sie den Gürtel nicht unbedingt enger schnallen, schließlich möchte wohl niemand im Angriffsfall am falschen Ende gespart haben. Natürlich sind die Kosten auch im Fall von SIEM-Lösungen ein Faktor, bei der Berechnung gilt es allerdings auf Feinheiten zu achten. SIEM-Lösungen, die in Form eines Cloud-Service angeboten werden, stehen fast immer in einem Abo-Modell zur Verfügung. Dabei können jedoch auch Nutzungsgebühren anfallen, beispielsweise für: das Volumen der Event-Daten oder die Anzahl der überwachten Endpunkte. Achten Sie bei Plattformen, die mit einer Open-Source-Lizenz angeboten werden, zudem auf versteckte Kosten (beispielsweise für Support) und stellen Sie sicher, dass die gewählte Lösung sämtliche relevanten, geschäftlichen Anforderungen erfüllt. Wenn Sie Ihr persönliches SIEM-Kandidatenfeld auf diejenigen eingegrenzt haben, die die benötigten Funktionen bieten, vergleichen Sie die voraussichtlich anfallenden Abonnement- und Nutzungsgebühren im Detail. SIEM-Anbieter & -Lösungen Der Markt für SIEM-Lösungen ist reich an Optionen. Um Ihnen den Einstieg in die Tool-Recherche zu erleichtern, haben wir einige, wichtige SIEM-Anbieter, respektive -Produkte, für Sie zusammengestellt: Datadog Cloud-SIEM ist eine ausgereifte SIEM-Suite, die sämtliche wichtigen Bereiche umfasst und mehr als 800 Integrationen sowie über 350 vorgefertigte Detection-Regeln bietet. Elastic Logstash ist keine echte SIEM-Plattform, das Open-Source-Tool (in erster Linie für die DevOps-Welt konzipiert) ermöglicht es aber, Log-Events aus einer Vielzahl von Quellen zu analysieren und zu verarbeiten. Exabeam LogRhythm SIEM ist einem Zusammenschluss der Sicherheitsanbieter Exabeam und LogRythm entsprungen und zeichnet sich in erster Linie durch ein umfassendes Ökosystem und vorgefertigte Compliance-Frameworks aus. Fortinet FortiSIEM ermöglicht Asset-Erkennung und rollenbasierten Zugriff, sowie User and Entity Behavior Analytics (UEBA), und kann sowohl integriert werden, um Events zu erfassen, als auch, um automatisiert auf diese zu reagieren. Huntress Managed SIEM ist ein solides, modernes Managed SIEM von einem aufstrebenden Anbieter, dessen Analysten und Security Engineers interne Teams entlasten können. IBM QRadar SIEM ist in der Lage, Datenmengen und Funktionen im Enterprise-Format zu bewältigen, verfügt über eine integrierte Analytics-Engine, KI-Funktionen und bietet Support für mehr als 500 Integrationen. LogPoint SIEM & SOAR setzt UEBA für Threat Modeling und Machine Learning ein, unterstützt automatisierte Übersetzungen sowie wichtige Compliance-Standards und korreliert Ereignisse auch mit dem MITRE ATT&CK-Framework. Microsoft Sentinel ist in der Lage, Ereignisse sowohl von lokalen, als auch von Cloud- Ressourcen einzuspeisen, zu korrelieren und zu analysieren, dabei hilft inzwischen auch die KI in Form von Microsofts Security Copilot. OpenText Enterprise Security Manager kann alle Anforderungen an ein Enterprise-SIEM erfüllen, bietet zahlreiche Integrationen mit Drittanbieter-Systemen und umfassenden Support für Automatisierung. NetWitness bietet ebenfalls diverse Enterprise-SIEM-Funktionen, zeichnet sich aber vor allem durch seine integrierten Encryption-Tools aus, die Support für verschlüsselte Event-Daten (oder Netz-Traffic) bieten. SentinelOne Singularity AI SIEM setzt auf State-of-the-Art-Techniken, um Daten zu erfassen und zu filtern, liefert robuste Analysen und verspricht intuitive Automatisierungen. SolarWinds Security Event Manager bietet zwar weder ML-basierte Datenanalysen, noch kann es in Sachen Integrationen mit den anderen hier aufgeführten Optionen mithalten, dafür bietet es USB Device Monitoring und beeindruckende Compliance-Reporting-Fähigkeiten. Splunk bietet seine SIEM-Plattform, die sich insbesondere durch ihr Ökosystem (beziehungsweise ihren App Store) auszeichnet, in zwei Versionen an: Splunk Enterprise für den On-Premises-Einsatz und Splunk Cloud als SaaS-Modell. Trellix Enterprise Security Manager stellt Benutzern umsetzbare Warnmeldungen zur Verfügung und legt den Fokus auf Flexibilität, wenn es um Architektur und Integrationen geht. Sie wollen weitere interessante Beiträge rund um das Thema IT-Sicherheit lesen? Unser kostenloser Newsletter liefert Ihnen alles, was Sicherheitsentscheider und -experten wissen sollten, direkt in Ihre Inbox.
Schwachstellen managen: Die besten Vulnerability-Management-Tools

www.csoonline.com · 2 months ago

There are six vulnerability management solutions highlighted as setting new standards: Qualys VMDR, Orca Security, Detectify, Kenna Security Vulnerability Management, Flexera Software Vulnerability Management, and Tenable.io. Qualys VMDR delivers cloud based scanning, passive network discovery and integrated patch deployment across on premises, cloud and endpoints. Orca uses side scanning to map cloud assets and prioritize risk, Detectify focuses on attack surface management with continuous internet facing and application monitoring plus crowdsourced researcher findings, and Kenna aggregates alerts from many scanners and applies real time threat intelligence and risk based SLAs while being part of Cisco. Flexera concentrates on vulnerabilities in third party software and automates patch prioritization and Tenable.io combines active and passive scanning, cloud connectors and machine learning to make vulnerability data actionable for remediation.
Security-Infotainment: Die besten Hacker-Dokus

www.csoonline.com · 2 months ago

Sie fühlen sich leer ohne Security-Dashboard? Diese Dokumentationen überbrücken den Schmerz bis zum nächsten Arbeitstag. Foto: Gorodenkoff, shutterstock.com Wenn Sie in Ihrer Profession als Sicherheitsentscheider voll aufgehen, brauchen Sie möglicherweise auch zwischen den Arbeitstagen ihre tägliche Dosis Cybersecurity. Falls Ihnen die zahlreichen Annäherungen Hollywoods an das Thema viel zu weit von der Realität entfernt sind, können Sie auf ein Füllhorn hochwertiger Dokumentationen zurückgreifen. Die sind nicht nur informativ, (meist) sehr nah an der Realität und unterhaltsam, sondern teilweise auch historisch wertvoll und in einigen Fällen kostenlos in voller Länge verfügbar. Doku-Highlights für Sicherheitsentscheider Nachfolgend haben wir diverse sehenswerte Dokumentationen in Zusammenhang mit Cybersecurity und Hacker-Kultur für Sie zusammengestellt. Viel Spaß! Hackers, Wizards of the Electronic Age (1985) Kurz und knapp: frühe Doku über die Hacker Community unter anderem mit Steve Wozniak kostenlos in voller Länge verfügbar Hackers in Wonderland (2000) Kurz und knapp: porträtiert UK- und US-Hacker beleuchtet Hacktivismus kostenlos in voller Länge verfügbar Secret History of Hacking (2001) Kurz und knapp: fokussiert frühe Hacking-Techniken mit John Draper, Steve Wozniak und Kevin Mitnick kostenlos in voller Länge verfügbar Hackers Are People Too (2008) Kurz und knapp: von Hackern kreiert will mit Stereotypen aufräumen beleuchtet auch die Rolle der Frauen in der Community We Are Legion: The Story of the Hacktivists (2012) Kurz und knapp: beleuchtet das Hacker-Kollektiv Anonymous zahlreiche O-Töne von Mitgliedern und Experten auf diversen Filmfestivals ausgezeichnet DEFCON: The Documentary (2013) Kurz und knapp: stellt das 20-jährige Jubiläum der Hacking-Konferenz DEFCON in den Fokus bis zu dieser Doku herrschte auf der Konferenz striktes Kameraverbot O-Töne von Teilnehmern und Verantwortlichen Citizenfour (2014) Kurz und knapp: thematisiert Edward Snowden und den NSA-Skandal enthält Interviews mit Snowden aus dem Jahr 2013 entstand unter Beteiligung von Glenn Greenwald Digital Amnesia (2014) Kurz und knapp: wirft ein Schlaglicht auf digitale Daten und den Umgang mit diesen mit Beteiligung von Experten des Internet Archive kostenlos in voller Länge verfügbar Deep Web (2015) Kurz und knapp: thematisiert den Darknet-Marktplatz Silk Road beleuchtet dabei auch die Verhaftung und den Prozess von Gründer Ross Ulbricht O-Töne von zahlreichen Beteiligten A Good American (2015) Kurz und knapp: erzählt die Geschichte des Ex-NSA-Direktors Bill Binney klärt auf, wie ein Computerprogramm 9/11 hätte verhindern können Regie führte der Österreicher Friedrich Moser War for the Web (2015) Kurz und knapp: wirft einen Blick auf die physische Infrastruktur hinter dem Internet zeigt, wie Unternehmen und Regierungen hinter den Kulissen um die Vorherrschaft kämpfen beleuchtet dabei auch Fragen wie Data Ownership, Datenschutz und Security Cyber War (2016) Kurz und knapp: zeigt, wie Regierungen im Kampf gegen kriminelle Hacker aufrüsten dabei kommen auch unlautere Mittel wie Spionage zur Sprache viele prominente O-Töne Down the Deep Dark Web (2016) Kurz und knapp: bietet Insider-Einblicke in das Darknet beleuchtet dabei auch legitime Einsatzzwecke will mit Vorurteilen und Stereotypen aufräumen Zero Days (2016) Kurz und knapp: erzählt die Geschichte des Stuxnet-Virus analysiert ausgiebig die Folgen des Angriffs bietet zahlreiche Insider-Einblicke und O-Töne Facebook: Cracking the Code (2017) Kurz und knapp: beleuchtet die Security-Kultur und -Probleme bei Facebook geht dabei auch auf die Nutzung von User-Daten, Ad-Gebahren und Fake News ein zahlreiche O-Töne von Experten Kim Dotcom: Caught in the Web (2017) Kurz und knapp: erzählt die Geschichte von Megaupload-Gründer Kim Schmitz beleuchtet dabei seinen Kampf gegen die US-Regierung und die Entertainment-Branche zahlreiche O-Töne von Beteiligten, auch Kim selbst The Defenders (2018) Kurz und knapp: analysiert vier schlagzeilenträchtige Cyberattacken nimmt dabei die Perspektive der Verteidiger ein produziert vom Sicherheitsanbieter Cybereason The Great Hack (2019) Kurz und knapp: thematisiert den Skandal um Facebook und Cambridge Analytica nimmt dabei die Perspektive verschiedener Beteiligter auf aufwändig produziert HAKMTL (2019) Kurz und knapp: kanadische Hacker stellen die Datenschutz-Versprechen von Unternehmen auf die Probe dabei liegt ein Fokus auf Überwachungstechnologien interessante Insider-Einblicke und O-Töne WannaCry: The Marcus Hutchins Story (2019) Kurz und knapp: erzählt die Geschichte des IT-Experten, der WannaCry durch Zufall stoppte und anschließend in Zusammenhang mit einem Banking-Trojaner verhaftet wurde dabei kommt auch Hutchins selbst zu Wort KnowBe4: The Making of a Unicorn (2020) Kurz und knapp: erzählt die Gründungsgeschichte des Security-Unternehmens KnowBe4 mit Beteiligung von Chief Hacking Officer Kevin Mitnick produziert vom Cybercrime Magazine MY.DOOM: Earth’s Deadliest Computer Viruses (2021) Kurz und knapp: thematisiert den Computervirus MyDoom aus dem Jahr 2004 analysiert dabei auch seine Auswirkungen kostenlos in voller Länge verfügbar Biggest Heist Ever, Der große Bitcoin-Raub (2024) Kurz und knapp: thematisiert den Hackerangriff auf die Hong Konger Kryptobörse Bitfinex aus dem Jahr 2016 beleuchtet den Werdegang von Ilya Lichtenstein und Heather Morgan, die für den Angriff verurteilt wurden diverse O-Töne von Ermittlern, Freunden, Betroffenen, und auch von Ilya Lichtenstein selbst Most Wanted: Teen Hacker (2025) Kurz und knapp: beleuchtet die Cybercrime-Karriere des finnischen Hackers Julius Kivimäki enthält Interviews mit Strafverfolgungsbehörden und Opfern des Cyberkriminellen auch Kivimäki selbst kommt zu Wort Joybubbles (2026) Kurz und knapp: erzählt die Geschichte des blinden Telefonhackers Joe Engressia aus dessen eigener Perspektive ursprünglich als Kickstarter-Projekt gestartet erfolgreiche Premiere auf dem Sundance Film Festival 2026 Sie wollen weitere interessante Beiträge rund um das Thema IT-Sicherheit lesen? Unser kostenloser Newsletter liefert Ihnen alles, was Sicherheitsentscheider und -experten wissen sollten, direkt in Ihre Inbox.
New Age of Collisions: Reading Arbitrary Files Pre-Auth as root in cPanel (CVE-2026-29205)

slcyber.io · 2 months ago

There is a pre authentication path traversal in cPanel CalDAV that allows reading arbitrary files as root by abusing the managed attachment GET handler and an ineffective privilege drop, tracked as CVE-2026-29205. The flaw occurs because raw URIs are validated before percent decoding so encoded slashes bypass structural checks, and a temporary ReducedPrivileges object is destroyed before file reads, restoring root privileges. Exploitation requires creating a mailbox directory containing the string -attachment- which can be induced by sending mail to a valid virtual email address using a plus alias so that Dovecot autocreates a Maildir folder, and researchers observed roughly a ten percent success rate when spraying common usernames against exposed cpdavd ports. A patch and advisory have been released, and the research also references a related authentication bypass tracked as CVE-2026-41940 and prior cPanel research CVE-2023-29489.
Dozens of Polymarket Bets Show Signs of Insider Trading, The Times Finds

www.nytimes.com · 2 months ago

There are dozens of long shot bets on Polymarket that have defied the odds, with reporting and data analyses finding recurring patterns of well timed, high value wagers tied to major geopolitical and military events. Federal investigators and prosecutors have opened probes and brought charges, including an indictment in the Southern District of New York accusing a U.S. servicemember of placing bets on a raid he participated in that yielded substantial profits. Independent researchers and watchdog groups report that defense related long shot wagers have paid off far more often than expected, prompting Polymarket to publish enhanced market integrity rules and to deploy new detection tools and analytics partnerships. Lawmakers and regulators are increasing scrutiny of prediction markets and considering new oversight and enforcement measures to prevent the misuse of nonpublic or classified information.
Meta Reassigns 7,000 Employees to Focus on A.I.

www.nytimes.com · 2 months ago

Meta is reallocating about 7,000 employees into new AI-focused roles and cutting some managerial positions as part of an organizational restructuring announced May 18, 2026. The announcement came two days before the company plans to lay off roughly 10 percent of its workforce, or about 8,000 employees, with notifications scheduled for May 20, 2026. Company leaders framed the changes as efforts to improve AI workflows and engineering productivity while funding large increases in compute and infrastructure spending.
After Elon Musk’s Court Loss Comes the Long Hot A.I. Summer

www.nytimes.com · 2 months ago

A federal jury unanimously rejected Elon Musk's lawsuit against OpenAI and Sam Altman, ruling the claims were time barred after a three week trial. The verdict clears OpenAI and its leadership of liability, reducing legal uncertainty that analysts say will ease the company’s path to fundraising and a possible public offering and is expected to accelerate AI development. The trial featured testimony from Musk, Altman and other tech executives and drew protests outside the courthouse, underscoring public concern about the pace and risks of artificial intelligence.
Five Takeaways From the Blockbuster Trial Pitting Elon Musk Against OpenAI

www.nytimes.com · 2 months ago

A jury rejected Elon Musk's lawsuit as time barred after less than two hours of deliberation, concluding he had waited too long to sue. Three weeks of testimony nevertheless produced illuminating details about interactions, decisions, and communications between Mr. Musk and OpenAI. Witness accounts and documents highlighted the early dynamics and disputes that underpinned the legal clash. The verdict underscored the limits on delayed legal claims while revealing substantive context about the disagreement.
How Storm-2949 turned a compromised identity into a cloud-wide breach

www.microsoft.com · 2 months ago

Storm-2949 turned stolen Microsoft Entra ID credentials into a cloud wide breach that exfiltrated data from Microsoft 365 applications and multiple Azure services. The actor used targeted social engineering to abuse the Self Service Password Reset process and trick users into approving multifactor authentication prompts, then used Microsoft Graph API enumeration and privileged Azure role based access control to retrieve App Service publishing profiles, Key Vault secrets, storage account keys and SQL credentials without deploying malware. The threat actor manipulated management plane operations and administrative features such as Kudu, VM Run Command and VM access extensions to execute commands, download large volumes of files and database contents, and remove firewall rules to evade detection.
INTERPOL ‘Operation Ramz’ seizes 53 malware, phishing servers

www.bleepingcomputer.com · 2 months ago

Operation Ramz, coordinated by INTERPOL across 13 Middle East and North Africa countries, led to 201 arrests and identified another 382 suspects. Authorities seized 53 servers used for phishing, malware, and online fraud, recovered nearly 8,000 intelligence packages that revealed at least 3,867 confirmed victims, and disrupted malicious infrastructure. INTERPOL collaborated with private cybersecurity firms including Kaspersky, Group-IB, The Shadowserver Foundation, Team Cymru, and TrendAI, and authorities highlighted cases such as a disabled malware-infected server in Oman, a dismantled investment scam in Jordan involving trafficked workers, and the shutdown of a phishing-as-a-service platform in Algeria.
Is 2026 the Year AI Bills of Materials Get Real?

www.darkreading.com · 2 months ago

AI bills of materials extend traditional software BOMs to catalog models, datasets, training history, licensing, hyperparameters, deployment context, retrieval sources, tool integrations, and governance artifacts so organizations can assess AI behavior and risk. Regulators and standards bodies in the United States, Europe, and the G7 are increasingly requiring or recommending AI BOM elements, and the EU AI Act is scheduled to take effect in August 2026, raising expectations for documentation of high risk systems. Practical adoption remains limited because many organizations lack data lineage and provenance, while rapid growth in model repositories and reports of malicious or backdoored models are expanding the AI attack surface and increasing the urgency for usable AI BOM tooling.
Microsoft Exchange Zero-Day Under Attack, No Patch Available

www.darkreading.com · 2 months ago

A zero day tracked as CVE-2026-42897 stems from a cross site scripting vulnerability that can execute arbitrary JavaScript in Outlook Web Access when a specially crafted email is opened under certain interaction conditions and is being actively exploited. The flaw affects on premises Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition and can allow attackers to access victims' mailboxes and session tokens, read and send email as the victim, and plant forwarding rules that can survive password resets, enabling business email compromise and follow on ransomware. Microsoft assigned the issue a CVSS score of 8.1 while the NIST National Vulnerability Database lists a 6.1 severity, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. Microsoft provided mitigations including enabling the Exchange Emergency Mitigation Service, which is enabled by default for many installations, and an updated on premises mitigation tool while it develops a security update with no timetable for release.
SHub macOS infostealer variant spoofs Apple security updates

www.bleepingcomputer.com · 2 months ago

A new SHub macOS infostealer variant called Reaper uses the applescript URL scheme to open Script Editor with a malicious AppleScript that displays a fake Apple security update referencing XProtectRemediator, downloads and executes a shell payload, and installs a backdoor. It fingerprints hosts for virtual machines and VPNs, skips systems using a Russian keyboard, prompts for the macOS password to access Keychain items, and exfiltrates browser data, cryptocurrency wallet extensions and desktop wallets, password manager extensions, iCloud and Telegram data, developer configuration files, and targeted documents using a Filegrabber with size limits. To evade detection and persist, the malware clears quarantine attributes, uses ad hoc code signing on modified application bundles, injects a malicious app.asar into wallet applications, and registers a LaunchAgent impersonating a Google software update that beacons to command and control and can fetch and execute additional payloads.
'Claw Chain' Vulnerabilities Threaten OpenClaw Deployments

www.darkreading.com · 2 months ago

Four chainable vulnerabilities in the OpenClaw AI agent framework, patched for all versions prior to April 23, 2026, allow attackers to gain initial access, steal credentials, escalate privileges, and establish persistent backdoors. The flaws include CVE-2026-44112 with a CVSS score of 9.6, a time of check time of use race condition in the OpenShell sandbox that enables system configuration modification and persistence; CVE-2026-44115 with a CVSS of 8.8 that exposes API keys and tokens; CVE-2026-44118 with a CVSS of 7.8 that permits privilege escalation via improper session validation; and CVE-2026-44113 with a CVSS of 7.8, another TOCTOU allowing improper access to configuration files and secrets. Security vendor Cyera reported the vulnerabilities, dubbed the Claw Chain, and warned that an attacker can chain them from a single supply chain style foothold such as a malicious plug in, a manipulated prompt, or other external data source and then use the agent's legitimate capabilities to move through credential theft, privilege escalation, and persistence while evading conventional detection. The report urges organizations to apply least privilege, governance, and visibility when deploying agentic AI because OpenClaw requires intrusive access to files, input devices, and services, and earlier OpenClaw bugs have included CVE-2026-25253, CVE-2026-24763, CVE-2026-25157, and CVE-2026-25475.
The quiet death of behavioral anti-bot and the pivot to hardware ZKPs

world.org · 2 months ago

A forensic investigation found that a sophisticated layer seven campaign fully bypassed an industry leading enterprise web application firewall that relied on machine learning based behavioral analysis and cursor entropy. Multimodal large language models can now solve dynamic captchas and convincingly spoof human interaction metrics, driving the adversary cost to generate human like traffic to near zero. As a result, software only anti sybil measures are mathematically ineffective and the root of trust must be anchored in physical hardware. Hardware devices acting as trusted execution environments that process biometric data locally and emit zero knowledge proofs of unique personhood while keeping raw images on device are emerging as the primary mitigation, prompting a projected architectural overhaul for high security endpoints in 2026.
CISA Admin Leaked AWS GovCloud Keys on Github

krebsonsecurity.com · 2 months ago

There was a public GitHub repository named Private-CISA maintained by a contractor that exposed credentials for several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. The archive contained administrative AWS GovCloud keys, plaintext usernames and passwords, tokens, logs, and files detailing how CISA builds, tests and deploys software, as well as access to the agency’s internal artifactory that could enable persistent supply chain compromise. The repository was created on November 13, 2025, was flagged by GitGuardian on May 15, 2026, and was taken offline after notification, yet the exposed AWS keys remained valid for about 48 hours; the maintainer had disabled GitHub secrets detection and used easily guessed passwords. CISA says it is investigating, reports no indication that sensitive data was compromised, and the contractor was associated with Nightwing.
Here’s the latest.

www.nytimes.com · 2 months ago

NULL