Blahalla

Here’s what was on the jury’s list for a decision.

www.nytimes.com · 2 months ago

A nine-member jury in Oakland was given a special verdict form asking whether OpenAI and its founders breached a charitable trust, whether they were unjustly enriched, whether Microsoft aided and abetted a breach, and whether those claims were barred by the applicable statute of limitations. After roughly two hours of deliberation the jurors returned a unanimous advisory verdict that Elon Musk’s claims were time barred, and the judge accepted the advisory verdict and dismissed the case. The three-week trial centered on when donors learned about OpenAI’s shift toward a for-profit affiliate and whether Microsoft’s large investments changed the charity’s course.
Microsoft May security patch fails for some due to boot partition size glitch

www.csoonline.com · 2 months ago

There are Windows 11 devices where the May Security Update fails to install because the EFI System Partition lacks sufficient free space, typically around ten megabytes or less. On affected machines the update can pass initial phases but then fail during the reboot phase at about thirty five to thirty six percent, leaving systems unpatched. Microsoft advised changing a Windows registry setting to force the update or rolling back and waiting for a future fix, while consultants recommended increasing the ESP to about one and a half gigabytes and testing any registry workaround on pilot devices with registry backups. Security and IT experts warned this failure undermines trust in the update process and urged adding ESP free space checks to endpoint health reporting, updating gold images, and treating boot partition cleanup or resizing as routine lifecycle engineering to avoid large-scale exposure.
Shai-Hulud Worm Clones Spread After Code Release

www.darkreading.com · 2 months ago

Shai Hulud source code was published publicly and multiple clones have appeared in NPM packages, indicating the worm is already spreading beyond the original campaign. Clones included a near verbatim copy with replaced command and control endpoints, Axios typosquats, and a distributed denial of service botnet payload, showing attackers can quickly swap C2 and signing keys and mass produce varied infostealer payloads. Researchers warn this represents a new automated supply chain attack paradigm that weaponizes developer identity and the implicit trust in CI CD pipelines, creating populations of variants that evade single signature defenses. Recommended mitigations include blocking lifecycle scripts by default, enforcing a release cooldown, detecting trust downgrades, treating CI CD as an attack surface, rotating credentials on developer workstations and CI runners that touched affected packages, and auditing which dependencies require install time code execution.
What to Know About Elon Musk’s Trial Against OpenAI

www.nytimes.com · 2 months ago

A federal jury in Oakland, California, unanimously rejected Elon Musk's lawsuit against OpenAI and its CEO Sam Altman on May 18, 2026, finding the claims were barred by the statute of limitations after a three week trial. Jurors deliberated for about two hours before returning the verdict, ending a trial that exposed internal disputes over OpenAI's shift from a nonprofit and included testimony from prominent technology figures. The decision removes a major legal cloud over OpenAI, easing uncertainty about its planned public offering and its role in the global race to develop and commercialize advanced artificial intelligence.
Grafana Rejects Ransom Demand After GitHub Breach Exposes Codebase Theft

www.techrepublic.com · 2 months ago

Grafana confirmed that an unauthorized actor used a compromised GitHub access token to access its GitHub environment and download parts of the company codebase. The company says its investigation found no evidence that customer data, personal information, customer systems, or operations were accessed or affected, and it revoked the compromised token and deployed additional security controls. After the theft the actor attempted to extort Grafana, which declined to pay following law enforcement guidance, and no stolen data had been publicly leaked at the time of reporting. Security reporting indicates a relatively new extortion group calling itself CoinbaseCartel has claimed responsibility and experts warn the incident highlights a rise in credential based attacks against developer environments and software supply chains.
5 Steps to Managing Shadow AI Tools Without Slowing Down Employees

www.bleepingcomputer.com · 2 months ago

There are five recommended steps to manage shadow AI tools without slowing employees: build a full inventory, write a practical policy, create a fast lane for new tool requests, use monitoring as a shared safety layer, and make secure behavior easy. Discover which AI tools are running by auditing OAuth connections, scanning browser extensions, checking AI features inside approved vendors, and surveying employees to record who is using what and what data is exposed. Policies should list approved tools, specify data categories that must never be entered into AI, require verified data training opt-outs, and define a short, structured intake with clear evaluation criteria. Browser-native monitoring combined with just-in-time coaching and plain-language training makes the secure choice the easy choice and helps shadow AI usage decline over time.
AudioHijack: adversarial audio attacks on generative voice models transfer from open weights to Microsoft and Mistral production systems

spectrum.ieee.org · 2 months ago

New research shows imperceptible audio manipulations can hijack large audio language models, achieving average success rates between 79 percent and 96 percent and working regardless of the user instructions. The manipulations are shaped to sound like natural reverberation so humans cannot hear them, and adversarial clips developed against open models were found to transfer to commercial systems from Microsoft and Mistral while models from OpenAI and Anthropic were harder to attack. Six attack categories were demonstrated, including refusing user requests, returning false information, inserting malicious links, swapping persona, claiming it cannot process audio, and triggering unauthorized tool use, and attacks can be delivered via poisoned online audio, music, voice notes, transcription feeds, or live voice chats. Common defenses had limited effect, with few shot prompting reducing success by about seven percent and self reflection catching about twenty eight percent, while monitoring internal attention patterns was most effective but can be evaded by reduced attention manipulation.
ShinyHunters Stole 275 Million Student Records. The Ransom Deadline Is May 12.

www.hitechies.com · 2 months ago

A ransomware group called ShinyHunters claims to have stolen data from Canvas, a learning management system used by approximately 275 million students and teachers across 8,809 schools. The breach occurred on April 25, and a ransom deadline of May 12 has been set. The group previously targeted Ticketmaster, Salesforce, and Instructure itself, and threatens to release private messages and student records if their demands are not met. Institutions are advised to change passwords, enable multi-factor authentication, and prepare for potential data publication.
Leaked Shai-Hulud malware fuels new npm infostealer campaign

www.bleepingcomputer.com · 2 months ago

A Shai-Hulud supply chain campaign compromised dozens of TanStack and Mistral AI packages and quickly spread to other projects, publishing at least 84 malicious versions across 42 TanStack packages and affecting hundreds of npm and PyPI packages. The attackers chained a risky pull request target workflow, GitHub Actions cache poisoning, and OIDC token theft from runner memory to publish malicious packages with valid SLSA provenance, and abused an orphan commit referenced as an optional dependency so npm would fetch and execute attacker code. The payload is a credential-stealing worm that harvests GitHub Actions OIDC tokens, personal access tokens, npm publish tokens, cloud and Kubernetes credentials, SSH keys, IDE configs and other secrets, exfiltrates data over the Session P2P network, embeds persistence in Claude Code hooks and VS Code auto-run tasks, self-propagates through stolen CI credentials, and in some locales includes a probabilistic destructive wipe routine.
What the jury had to weigh to decide the case.

www.nytimes.com · 2 months ago

NULL
INTERPOL Operation Ramz Disrupts MENA Cybercrime Networks with 201 Arrests

thehackernews.com · 2 months ago

There was a first of its kind INTERPOL coordinated cybercrime crackdown across the Middle East and North Africa called Operation Ramz that ran from October 2025 to February 2026, involved 13 countries, and resulted in 201 arrests plus the identification of 382 additional suspects. The operation disrupted phishing and malware infrastructure, identified 3,867 victims, and led to the seizure of 53 servers, including the takedown of a phishing as a service platform in Algeria, seizures of devices containing banking data in Morocco, and the disabling of a compromised residential server in Oman that contained critical vulnerabilities and malware. Investigators also found devices in Qatar being used without the owner’s knowledge, uncovered a Jordanian fraud scheme that exploited trafficked individuals, and relied on private sector intelligence that flagged over 5,000 compromised accounts to support enforcement actions.
Apple’s Siri Revamp May Add Auto-Deleting Chats

www.techrepublic.com · 2 months ago

Apple is reportedly developing a standalone Siri app that would let users choose how long AI conversations are saved with options such as 30 days, one year, or forever. The retention controls are expected to be part of a privacy-focused push at WWDC 2026, which begins on June 8, 2026. The enhanced Siri is reported to use Google Gemini models, a detail that could complicate Apple’s privacy messaging, and IT leaders will need to assess how conversation history and retention settings align with mobile device management and data governance.
Banned Nvidia AI Chips Keep Reaching China Despite US Crackdown

www.techrepublic.com · 2 months ago

There are alleged networks using encrypted messages, front companies, and third country intermediaries to divert restricted Nvidia GPUs and other US technology to China and Russia despite export controls. Court filings name individuals including Matthew Kelly, Stanley Yi Zheng, and Tommy Shad English and show tactics such as avoiding explicit mention of China, while other prosecutions allege smuggling of 400 Nvidia A100 chips through Malaysia and Thailand and a separate case involving a 2.5 billion dollar server shipment. The Bureau of Industry and Security has increased enforcement but faces challenges tracking diversion routes, reporting nearly 420 million dollars in penalties and forfeitures and high profile fines including a 252 million dollar penalty against Applied Materials and a 95 million dollar settlement by Cadence.
Did You Mean to Share That Selfie? What to Know About Instagram Instants.

www.nytimes.com · 2 months ago

Instagram rolled out Instants, a feature and companion app that lets users capture unedited photos and send them to either their Close Friends or mutual followers where they disappear after being viewed or after 24 hours. Instants must be taken from the in-app camera or the Instants app, cannot be edited or uploaded from the gallery, include a brief undo window immediately after sending, and Instagram says recipients cannot screenshot or screen record shared Instants. The feature is pitched as a low pressure way to share candid moments, but early user reports and commentary highlight confusing UX patterns such as instant sending without a preview and difficulty knowing who has seen a sent Instant.
AI cyberattackers are getting better faster

www.csoonline.com · 2 months ago

There are new benchmarks from the UK AI Security Institute showing AI models can perform end to end, multi stage penetration tests that match human capabilities, with the difficulty of tasks the best models can complete doubling every eight months in November 2025 and accelerating to every 4.7 months by February 2026, and the latest Claude Mythos Preview and GPT 5.5 models demonstrating even greater capability. The time horizon benchmarks measure the longest task an AI can complete at an 80 percent success rate using estimated human work hours, require sustained multi step context and recovery from failures, and were capped at 2.5 million tokens which may limit longer running performance. The UK government warns these advances are translating into real risks for organizations with weak cyber defenses while also noting the same acceleration can improve defensive tools for proactive threat detection and automated response.
How to better protect your growing business in an AI-powered world

www.microsoft.com · 2 months ago

AI is rapidly reshaping work while increasing cyber risk, with AI automated phishing found to be 4.5 times more effective and attackers increasingly targeting identities and automating scams and malware. This shift makes cybersecurity a core business risk for growing companies because breaches and disruptions can cause financial loss and lasting damage to customer trust, and Microsoft reports it now processes more than 100 trillion security signals daily and blocks 4.5 million new malware files every day. Simple, built in protections that secure devices, identities, email, and cloud apps and that provide centralized visibility and automation help small and medium businesses reduce risk, and Microsoft highlights Microsoft 365 Business Premium as an example of an integrated, easy to manage solution.
Peter G. Neumann, Who Warned of Computer Security Risks, Dies at 93

www.nytimes.com · 2 months ago

Peter G. Neumann was a pioneering computer security expert who for decades criticized the industry’s lax attitudes toward computer security and individual digital privacy. He developed practical solutions and research contributions, including work on provably secure operating systems and early intrusion detection models while at SRI International and as editor and moderator of professional forums. His advocacy shaped public debate on security and privacy and influenced later tools and standards for detecting and mitigating systemic risks to users and infrastructure.
Fuel Tank Breaches Expand Scope of Iran's Cyber Offensive

www.darkreading.com · 2 months ago

Iranian hackers reportedly breached internet exposed automatic tank gauge systems that monitor fuel levels in storage tanks serving gas stations around the United States, altering display readings on the tanks without changing actual fuel quantities. The affected systems lacked password protections, illustrating long standing warnings that insecure ATG and other operational technology exposed to the internet can be tampered with to create cascading effects. There is no evidence of significant fuel supply disruption so far and definitive forensic attribution is lacking, but Iran is suspected because of past targeting of fuel infrastructure and the current conflict with the United States and Israel. Security experts urge removal of internet facing OT, stronger access controls, network segmentation, improved visibility, and resilience planning to reduce the blast radius of similar attacks.
⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More

thehackernews.com · 2 months ago

On-premises Microsoft Exchange Server is being actively exploited via a spoofing cross-site scripting vulnerability tracked as CVE-2026-42897, and Microsoft has provided a temporary mitigation through its Exchange Emergency Mitigation Service while preparing a permanent fix. Cisco Catalyst SD-WAN Controller has been targeted by a sophisticated actor exploiting a critical authentication bypass tracked as CVE-2026-20182, with links to prior exploitation of CVE-2026-20127 and observed post compromise activity including adding SSH keys and modifying NETCONF to escalate privileges. A supply chain campaign attributed to TeamPCP poisoned popular npm packages including TanStack and node-ipc to deliver stealer malware, a malicious Hugging Face model repository distributed a Rust based information stealer, and the ShinyHunters group claimed an agreement with Instructure to return and delete stolen data after a breach. Other high priority vulnerabilities flagged this week include CVE-2026-42945, CVE-2026-41096, CVE-2026-42826, CVE-2026-46333, and CVE-2026-45185 among many others.
Grafana says stolen GitHub token let hackers steal codebase

www.bleepingcomputer.com · 2 months ago

Grafana Labs disclosed that attackers used a stolen GitHub access token to breach its GitHub environment and download the company source code. An extortion group calling itself CoinbaseCartel claimed responsibility by listing Grafana on its data leak site, and Grafana says its investigation found no evidence of customer data exposure, invalidated the compromised credentials, and implemented additional security measures. Grafana declined to pay the ransom following FBI guidance, and researchers link CoinbaseCartel to affiliates of ShinyHunters and Lapsus$ that commonly gain access via social engineering, phishing, and compromised credentials.
The down fall of bug bounties

shubs.io · 2 months ago

AI is changing security research and the economics of bug bounties by enabling skilled researchers to work faster while amplifying low-skill participants who submit AI-generated, low-value reports. This influx of poor submissions is overwhelming triage teams, slowing meaningful response times and eroding researchers' motivation, with one vulnerability submitted April 24 not receiving a human response until May 6, a 12 day delay. Platforms are deploying AI defenses and stricter controls, but many experienced hunters are reducing participation or abandoning programs they once regularly contributed to.
The Boring Stuff Is Dangerous Now

www.darkreading.com · 2 months ago

There are AI agents that can systematically map third party ecosystems, identify obscure vulnerable components, and chain them to reach high value targets, eliminating obscurity as a defensive barrier. There are widespread mandates for developers to use AI coding tools that are producing large volumes of code with recurring implementation errors and misconfigurations, increasing the attack surface. There will be a surge in vulnerability reports that can overwhelm security teams, so prioritization must shift to trust path risk and actual business impact rather than asset prestige. Organizations should track transitive dependencies, data flows and permissions, patch root causes, remediate recurring vulnerability patterns, and feed this intelligence back into AI coding tools to reduce future risk.
How to Reduce Phishing Exposure Before It Turns into Business Disruption

thehackernews.com · 2 months ago

Early phishing detection closes the gap between a phishing email that looks routine and the business exposure that can follow, enabling security operations teams to move from uncertainty to evidence faster, reduce response delays, and prevent a single clicked link from becoming credential theft, remote access, or operational disruption. A three step approach is to validate suspicious links and attachments in interactive sandboxes to reveal redirects and credential prompts, expand analysis into campaign context by linking related domains and repeated URL patterns, and push behavior based indicators and campaign intelligence into SIEM, TIP, SOAR, NDR, and firewall controls for detection and containment. In one sandbox case the full attack chain was exposed in roughly forty seconds, and teams using these methods report faster mean time to remediate, dramatically faster triage, fewer escalations, and reduced Tier 1 workload.
Millions Impacted Across Several US Healthcare Data Breaches

www.securityweek.com · 2 months ago

Several major U.S. healthcare data breaches were added to the Department of Health and Human Services breach tracker, with the largest affecting New York City Health and Hospitals and listed as impacting 1.8 million individuals; that breach was detected on February 2, 2026 and investigators found threat actors had access between November 2025 and February 2026 through a third party, exposing personal, health insurance, medical, biometric, and financial information. Other incidents added to the tracker include Erie Family Health Centers in Chicago with roughly 570,000 individuals affected after unauthorized access from December 10, 2025 to late January 2026, Florida Physician Specialists with about 276,000 affected after two days of access in November 2025, and breaches at Coastal Carolina Health Care and Western Orthopaedics each impacting about 110,000 people. The tracker also shows Nacogdoches Memorial Hospital listed at 2.5 million affected despite earlier reports of 250,000 and a small Arizona dermatology clinic whose initial 3 million figure was later updated to 500, and none of the newly added healthcare breaches appear to have been claimed by known cybercrime groups.
New image-based prompt injection attack targets multimodal AI models

www.csoonline.com · 2 months ago

There is a new image based prompt injection technique called CrossMPI developed by researchers at Xidian University that uses nearly imperceptible image perturbations to manipulate how large vision language models interpret both visual and textual inputs without changing the original text prompt. The attack targets intermediate fusion layers where visual and textual hidden states combine and achieved an average success rate of sixty six point three six percent across open source LVLMs including MiniGPT4, BLIP‑2, InstructBLIP, BLIVA, and Qwen2.5‑VL, outperforming prior baseline attacks by about forty one percentage points and showing strong black box transferability. Evaluated defenses such as random resizing, image rotation, JPEG compression, SmoothVLM, and partial image view methods reduced effectiveness in some cases with SmoothVLM lowering success rates below five percent in several scenarios and JPEG compression weakening high frequency artifacts, but none fully eliminated the threat. The research warns that enterprises deploying multimodal AI copilots, autonomous agents, and document processing systems could face increasing exposure because manipulated images can subvert sanitized textual inputs, although the study was conducted in controlled settings and did not report observed real world exploitation.
Gamaredon Deploys GammaDrop, GammaLoad in Phishing Campaigns

gbhackers.com · 2 months ago

There are multi stage phishing attacks by the Gamaredon threat group targeting Ukrainian government entities that deploy GammaDrop and GammaLoad downloaders and exploit CVE-2025-8088 a WinRAR directory traversal flaw that allows malicious files to be written outside intended extraction paths. The attacks use malicious RAR or ARJ archives containing decoy PDFs and hidden VBScript payloads placed via NTFS alternate data streams to drop GammaDrop into the Windows Startup folder for persistence while GammaDrop retrieves GammaLoad which executes as an HTA via mshta establishes RunOnce registry keys and beacons to Cloudflare Workers and fallback domains approximately every three and a half minutes while collecting basic system identifiers. There are at least twelve observed waves since September 2025 targeting institutions including the Security Service of Ukraine using rotated fast flux infrastructure and known relays in the 194.58.66.0/24 subnet and recommended mitigations include enforcing SPF DKIM and DMARC blocking known malicious IP ranges and patching WinRAR.
‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Delivery

www.securityweek.com · 2 months ago

There are four vulnerabilities in the OpenClaw AI assistant that can be chained to steal credentials, bypass sandbox restrictions, escalate privileges, and install persistent backdoors on the underlying host. An attacker who gains code execution inside the OpenShell sandbox can exploit a race condition CVE-2026-44113 to read files outside the mount root, an exec allowlist analysis bug CVE-2026-44115 to run unapproved commands, and an MCP loopback flaw CVE-2026-44118 to manipulate ownership and gain owner-level privileges. A separate critical race condition CVE-2026-44112 with a CVSS score of 9.6 enables writing data outside the sandbox to modify configurations and plant backdoors, and the issues were reported on April 22, 2026 with patches issued the next day.
‘Patched’ Windows bug resurfaces 6 years later as working SYSTEM-level exploit

www.csoonline.com · 2 months ago

There is an elevation of privilege flaw in the Windows Cloud Filter driver cldflt.sys that researchers say remains exploitable six years after a 2020 patch, with a public proof of concept called MiniPlasma able to elevate a standard user to SYSTEM on many modern builds though success can vary because it relies on a race condition. The behavior reproduces CVE-2020-17103, which Microsoft patched in December 2020 and assessed as less likely to be exploited, but follow up testing found the original exploit chain still works on fully patched systems while some Insider builds show mitigation. The disclosure is part of a larger 2026 run of Windows vulnerability releases by the researcher Nightmare Eclipse that also touched on CVE-2026-33825 and other local privilege escalation and bypass techniques.
Gremlin Stealer Hides Payloads in .NET Resources to Evade Detection

gbhackers.com · 2 months ago

There is a newly identified Gremlin Stealer variant that conceals its core payload inside.NET resource sections, encoding payloads with a simple XOR scheme and decrypting them in memory to reveal command and control URLs and execution logic. The malware uses a staged execution model and multiple obfuscation layers including identifier renaming, string encryption, control flow obfuscation, and commercial packing with instruction virtualization to evade static analysis and detection. It targets payment card data, browser cookies, session tokens, cryptocurrency wallets and Discord tokens, adds a crypto clipper and WebSocket session hijacking, and compresses stolen data into ZIP archives labeled with victims public IPs before uploading them to attacker controlled infrastructure, where researchers observed a newly deployed exfiltration server that initially showed zero detections on VirusTotal. Organizations are advised to monitor unusual outbound traffic, inspect memory resident behavior, and deploy advanced endpoint detection and prevention tools to identify and block Gremlin activity.
Boulevard of Broken Dreams: 2 Decades of Cyber Fails

www.darkreading.com · 2 months ago

There is widespread breach jadedness as consumers and organizations have been repeatedly affected by massive incidents over many years, with breach counts and victim notices rising dramatically. One of the most destructive supply chain incidents was the exploitation of CVE-2023-34362, an SQL injection in Progress Software's MOVEit Transfer that exposed data on nearly 100 million people and was heavily leveraged by the Cl0p threat group. Operational failures have also caused major real world disruption, exemplified by a July 19, 2024 CrowdStrike Falcon Sensor update that triggered blue screen crashes on millions of Windows devices, grounding flights, delaying surgeries, and prompting changes to vendor kernel level access policies. Industry dependence on a small set of cloud and security vendors has amplified systemic risk, keeping legacy tools like the SIEM in place while driving calls for staged rollouts, kill switches, and resilience by design.
TanStack Supply Chain Attack (And How to Lock Down GitHub Actions)

www.copilotkit.ai · 2 months ago

In May 2026 the TanStack router repository was compromised through its GitHub Actions pipeline when a fork pull request poisoned the Actions cache, extracted OIDC tokens, and allowed the attacker to publish 84 malicious npm packages that downstream installs pulled before detection. The attack used no zero days and relied on known misconfigurations including cache collisions between forks and upstream pull requests, overly broad token permissions, and running build and publish in the same job. An audit of 20 repositories found widespread issues such as unpinned actions, missing permissions blocks, shell injection vectors, credential persistence, dangerous workflow triggers, absent static analysis, lack of Dependabot for actions, and fork PR cache poisoning, and those issues were fixed using a common checklist. Recommended mitigations include SHA pinning every action, enforcing least privilege permissions, preventing shell injection through environment variable indirection and safe JSON construction, disabling credential persistence and doing late credential injection, separating build and publish jobs, adding continuous workflow scanning with Zizmor, using Dependabot or Renovate for Actions updates, and applying pnpm hardening to quarantine new packages.
7-Eleven Data Breach Confirmed After ShinyHunters Ransom Demand

www.securityweek.com · 2 months ago

7-Eleven confirmed a data breach after the ShinyHunters group claimed to have stolen more than 600,000 Salesforce records and listed the company on its leak site. An intrusion into systems used to store franchisee documents was detected on April 8, and security incident notices say unspecified personal information provided during franchise applications was compromised while only two Maine residents were identified as impacted. The attackers demanded a ransom by April 21, later offering the stolen data for sale for 250,000 dollars, and ShinyHunters has been linked to similar thefts from Salesforce instances using phishing, abuse of third party integrations, or misconfigurations rather than flaws in Salesforce products.
Developer Workstations Are Now Part of the Software Supply Chain

thehackernews.com · 2 months ago

Supply chain attackers are shifting focus from injecting malicious code to stealing access from developer environments, with three campaigns targeting npm, PyPI, and Docker Hub in a 48 hour window that harvested API keys, cloud credentials, SSH keys, and tokens. Developer workstations concentrate contextual data such as local repositories, dot files, shell history, package configs, build scripts, and browser sessions, allowing attackers to map credentials to repositories, CI workflows, and cloud resources. Automation and AI driven tooling compress the time between discovery and impact by auto-merging dependency updates, running workflows, and exposing sensitive data in prompts and agent memory. Security teams are urged to treat developer machines as local supply chain boundaries by identifying usable credentials, limiting credential value and lifetime, detecting secrets before they enter Git or CI, and revoking and rotating access rapidly.
Critical NGINX Vulnerability Lets Hackers Launch Remote Code Execution Attacks

gbhackers.com · 2 months ago

A newly disclosed vulnerability in NGINX, tracked as CVE-2026-42945, is being actively exploited and affects both NGINX Open Source and NGINX Plus, potentially allowing unauthenticated attackers to crash worker processes or achieve remote code execution under specific conditions. Attackers send specially crafted HTTP requests to trigger a heap buffer overflow in the NGINX worker process, with full remote code execution possible only when conditions such as ASLR being disabled and a specific rewrite configuration are present. Censys and VulnCheck analysis identified roughly 5.7 million internet facing NGINX servers running potentially affected versions, so even a small percentage meeting exploitation criteria could produce substantial exposure. Organizations are advised to urgently review rewrite configurations, apply available patches or updates, enable modern protections like ASLR, and monitor for unusual HTTP request patterns.
Microsoft testing adjustable taskbar, Start menu in Windows 11

www.bleepingcomputer.com · 2 months ago

There are resizable taskbar and Start menu options rolling out to Windows Insiders in the Experimental channel with Windows 11 Insider Preview Build 26300.8493, letting users move the taskbar to the bottom, top, left, or right of the screen and enable smaller taskbar buttons. Start menu controls now allow users to toggle off Recommended and All content, customize the Start menu size, hide their name and profile picture, and Microsoft will still maintain a list of recently installed apps while improving how files are displayed and ordered for relevance. Microsoft is also testing a modern Run dialog with dark mode that removes the Browse button and must be turned on manually in settings, and says these changes form part of broader efforts to improve Windows 11 performance, reduce notifications, simplify settings, and make search more consistent.
Zero-Day Exploit Against Windows BitLocker

www.schneier.com · 2 months ago

There is a zero day exploit named YellowKey that reliably bypasses default Windows 11 BitLocker protections but requires physical access to the computer. It was published this week by a researcher using the alias Nightmare Eclipse and targets default BitLocker deployments where the decryption key is stored in a trusted platform module. The exploit undermines the mandatory disk encryption relied on by many organizations, including government contractors, and exposes devices to data theft when attackers obtain physical access.
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws

thehackernews.com · 2 months ago

There are security updates from Ivanti, Fortinet, SAP, VMware, and n8n that fix multiple critical and high-severity vulnerabilities that could allow information disclosure, unauthenticated code execution, SQL injection, remote code execution, and local privilege escalation. CVE identifiers include CVE-2026-8043, CVE-2026-44277, CVE-2026-26083, CVE-2026-34260, CVE-2026-34263, CVE-2026-41702, CVE-2026-42231, CVE-2026-42232, CVE-2026-44791, CVE-2026-44789, and CVE-2026-44790.
Paper Werewolf APT Spreads EchoGather RAT via Fake Adobe Installer

gbhackers.com · 2 months ago

A Russian language threat cluster known as Paper Werewolf launched targeted cyberattacks against industrial, financial, and transport organizations in March and April 2026, delivering a fake Adobe Reader installer that silently deployed the EchoGather remote access trojan. The attack chain begins with a phishing email carrying a PDF that directs victims to a ZIP archive containing a bogus installer which extracts and launches EchoGather while showing a decoy document. EchoGather harvests system details including local IP, host name, user name, process information and file paths, exfiltrates data over HTTPS, supports file upload and download and remote command execution, and researchers also uncovered a VB dot NET stealer called PaperGrabber that harvests documents, SSH keys, VPN configurations, certificates, Telegram session data and browser credentials then sends exfiltrated data in 10 megabyte chunks to attacker infrastructure. The actors further deployed JavaScript shellcode downloaders disguised as a Node dot js environment, a C plus plus downloader with anti virtualization checks, a VBScript MSBuild loader, and advanced Mythic implants that use RSA 4096 key exchange and AES and support more than 30 post exploitation commands including process injection, keylogging, SOCKS proxying, registry manipulation and screenshot capture.
Researcher Drops MiniPlasma Windows Exploit for Unpatched 2020 CVE

www.securityweek.com · 2 months ago

There is a new exploit called MiniPlasma that targets a Windows Cloud Filter driver privilege escalation tracked as CVE-2020-17103 and rated CVSS 7.0. Project Zero reported the flaw in 2020 and Microsoft issued December 2020 updates, but the original proof of concept reportedly works unchanged, indicating the bug may still be present and allowing creation of registry keys in the DEFAULT user hive without access checks to elevate privileges. MiniPlasma has been shown to spawn a System shell on Windows 11 systems with May 2026 security updates installed, may not function on the latest Insider Preview Canary builds, and the researcher previously released similar exploits after criticizing Microsofts vulnerability response.
First Shai-Hulud Worm Clones Emerge

www.securityweek.com · 2 months ago

At least one threat actor began using clones of the Shai Hulud worm days after TeamPCP published the malware source code, and Shai Hulud had previously been used in supply chain attacks against the NPM ecosystem in September 2025 and November 2025 and resurfaced in April in campaigns impacting projects such as Trivy, Bitwarden, Checkmarx, SAP, and TanStack. A threat actor published four malicious NPM packages, including a direct clone named chalk template that contains the worm code, its own command and control server and private key, and that exfiltrates stolen credentials to a new code repository, while the other three packages used typo squatting to target Axios users and one turned infected machines into a DDoS botnet, together amassing over two thousand six hundred weekly downloads. Security researchers warn that rapid adaptation of the released source code and the variety of infostealer and propagation techniques indicate this is the first phase of a likely wave of supply chain attacks.
Hackers Abuse Cloudflare Storage to Exfiltrate Network Files

gbhackers.com · 2 months ago

A sophisticated cyber espionage campaign targeted multiple Malaysian organizations, with attackers operating from an Azure virtual machine at IP address 20.17.161.118 to orchestrate intrusions across government-linked networks. The campaign relied on custom tooling including purpose-built Python scripts, Laravel deserialization exploit chains, PHP webshells, and a private command and control framework, and used a list of 126 targeted credentials to gain administrator-level access. Attackers abused Cloudflare-hosted storage for data exfiltration using scripts such as genphotoupload.py to blend malicious uploads into legitimate cloud traffic and reduce detection. Researchers recovered Active Directory artifacts including SAM, SECURITY, and SYSTEM hives and NTDS dumps enabling offline credential extraction and long-term persistence, prompting containment recommendations to remove webshells, rotate domain credentials, and conduct deep forensic analysis.
Attacking Cloud Service Providers (ACSP) - An interactive textbook on control-plane intrusion and breaking cross-tenant isolation

senyuuri.github.io · 2 months ago

There is a semester-length interactive textbook called Attacking Cloud Service Providers that focuses on control-plane intrusion and breaking cross-tenant isolation, built from 275 real-world cloud service provider vulnerabilities across AWS, Azure, and GCP. It is intended for security engineers, vulnerability researchers, and red-teamers and teaches a six-part analytical lens covering plane, boundary, identity, shared resources, automation, and detection to reason about provider-side attacks and blast radius. The book contains 13 cumulative chapters covering cloud fundamentals, the CSP kill chain, identity federation, instance metadata and SSRF, control-plane network isolation, container and workload escape, storage and databases including ChaosDB, serverless and CI CD risks, AI ML service attack surfaces, cross-tenant synthesis, and logging and detection evasion.
Microsoft Acknowledges Windows 11 Update Failure Linked to Error 0x800f0922

gbhackers.com · 2 months ago

The May 12, 2026 cumulative update KB5089549 for Windows 11 versions 24H2 and 25H2 can fail to install and return error code 0x800f0922. The installation failure is frequently tied to limited free space on the EFI System Partition, with problems often occurring when about 10 megabytes or less remain. Microsoft has acknowledged the issue and is rolling out a Known Issue Rollback and targeted fixes, while some users report the update either rolls back automatically or, on systems where it completes, causes degraded network performance.
AI coding is fueling a secrets-sprawl crisis few CISOs are containing

www.csoonline.com · 2 months ago

Security researchers at Wiz and independent researcher Jameson O'Reilly discovered that Moltbook, an AI agent social network launched on January 28, 2026, had a misconfigured Supabase backend that exposed 1.5 million API authentication tokens, 35,000 email addresses, and private messages. AI assisted coding and vibe coding have accelerated secrets sprawl, with public code commits rising more than forty percent in 2025 and GitGuardian reporting a thirty four percent increase in leaked secrets on GitHub in 2025 to nearly 29 million exposed credentials, including 1.27 million AI related secrets, an eighty one percent year over year increase. Remediation should be treated as an incident response action that revokes and rotates exposed credentials, audits for unauthorized use, purges secrets from history, and follows with postmortems, yet GitGuardian found that sixty four percent of valid secrets identified in 2022 remained unrevoked in 2026, highlighting governance and ownership shortfalls. CISOs are advised to secure the full software development lifecycle and non human identities by enforcing credential vaulting, separation of duties, short lived credentials, automated rotation, clear ownership, and embedding security practices into developer workflows so identity governance shrinks secrets sprawl rather than relying solely on scanning.
Why the best security investment a board can make in 2026 isn’t another tool

www.csoonline.com · 2 months ago

There is a recurring pattern in boardrooms where security leaders present the threat landscape, boards fund another tool, and the same visibility gaps reappear because individual tools only illuminate separate corners of the environment. The highest-value security capability is visibility, meaning the ability to answer specific questions about assets, access and cross-system activity in minutes rather than relying on raw logs and delayed forensics. Attackers increasingly exploit the seams between tools, and the fastest-growing blind spot is unmanaged machine and automated credentials including service accounts, API keys, third-party integrations and AI agents. Boards should stop asking are we protected and instead ask what can we see, and invest in a complete, current inventory and the ability to reconstruct activity across systems before approving more detection tools.
MiniPlasma Windows 0-Day Enables SYSTEM Privilege Escalation on Fully Patched Systems

thehackernews.com · 2 months ago

A proof of concept released by researcher Chaotic Eclipse enables SYSTEM privilege escalation on fully patched Windows systems by exploiting a zero day called MiniPlasma. The flaw impacts the Windows Cloud Files Mini Filter driver cldflt.sys in a routine named HsmOsBlockPlaceholderAccess and was originally reported to Microsoft by Google Project Zero researcher James Forshaw in September 2020, with the issue thought fixed under CVE-2020-17103 but reportedly still present. The researcher weaponized the original PoC to spawn a SYSTEM shell that has been reported to work reliably on Windows 11 systems updated with the May 2026 patches while noting success may vary because the bug is a race condition, and a related privilege escalation in the same component was tracked as CVE-2025-62221.
Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware

thehackernews.com · 2 months ago

Cybersecurity researchers discovered four malicious npm packages named chalk-tempalte, a scoped package published by the user deadcode09284814 called axios util, axois-utils, and color-style-utils that deliver information stealing malware and a Golang based DDoS botnet. Analysis shows axois-utils drops a Golang Phantom Bot capable of HTTP, TCP and UDP floods and establishes persistence on Windows and Linux, while chalk-tempalte contains a near identical clone of the recently leaked Shai Hulud worm that exfiltrates stolen credentials to a remote command and control server and pushes data to a public GitHub repository using a stolen token. The other two packages siphon SSH keys, environment variables, cloud credentials, system information, IP addresses and cryptocurrency wallet data, and users who installed these packages are advised to uninstall them, remove malicious configuration from development tools and coding agents, rotate secrets, search for repositories named A Mini Sha1 Hulud has Appeared and block network access to suspicious domains.
Hackers Hide PureLogs Infostealer in PawsRunner Loader

gbhackers.com · 2 months ago

A recent campaign begins with phishing emails delivering a TXZ archive disguised as an urgent invoice that contains a heavily obfuscated JavaScript which sets environment variables and launches PowerShell via conhost.exe to decrypt an AES encrypted, Gzip compressed payload and execute it in memory. The decoded.NET loader, tracked as PawsRunner, decrypts RC4 encrypted command and control URLs, downloads additional payloads using HttpClient and WebRequest, and uses steganography to extract hidden encrypted payloads embedded inside PNG images by looking for specific PNG chunk markers such as iTXt and IEND. The final payload is PureLogs, a.NET infostealer that uses.NET Reactor and Protobuf, decrypts a resource only assembly with TripleDES, then downloads AES 256 encrypted modules that run in memory and harvest a wide range of data including browser credentials, cookies, autofill entries, cryptocurrency wallets, password managers, VPN configurations, files, and messaging data. The campaign includes persistence and Windows 11 evasion techniques, commonly uses cat themed icons as a recurring trait, exfiltrates collected data to command and control servers over encrypted and Gzip compressed HTTP posts, and illustrates a growing trend of hiding malware inside legitimate files and images to bypass traditional detection.
Critical Marimo RCE Flaw Could Let Attackers Execute Malicious Code Remotely

gbhackers.com · 2 months ago

A newly disclosed critical vulnerability in the Marimo Python notebook framework allows attackers to execute arbitrary commands remotely without authentication by exposing a WebSocket endpoint that can be abused to spawn a system level shell and potentially lead to full infrastructure compromise. The flaw is tracked as CVE-2026-39987 and has prompted urgent concern from the cybersecurity community.
Grafana Confirms Breach After Hackers Claim They Stole Data

www.securityweek.com · 2 months ago

Grafana confirmed on May 18, 2026 that it suffered a data breach after the company was listed on a cybercrime leak site. The intrusion exploited a compromised token that granted access to the Grafana Labs GitHub environment and allowed attackers to download the company codebase, while Grafana says no personal or customer information was stolen and customer systems were not impacted. Attackers demanded a ransom to prevent the source code from being leaked but Grafana refused to pay, has reset compromised credentials, and is conducting a forensic investigation. Security firms link the group calling itself Coinbase Cartel to ShinyHunters, Scattered Spider, and Lapsus, reporting the cartel has been active since September 2025 and lists over one hundred victims.