Blahalla

Most organizations aren’t ready for a Hugging Face-level event

www.csoonline.com · 2 months ago

The National Security Agency (NSA) and Central Security Service recently published an advisory statement on behalf of the Five Eyes Cyber Security Agencies, warning that AI technologies are making it easier than ever for would-be malicious actors to infiltrate and compromise sensitive networks. “AI is not a future consideration, it is already here,” the statement says.

AI triggers a wave of anxiety among the world’s greatest math minds

www.washingtonpost.com · 2 months ago

Top mathematicians gathered recently in San Francisco at the offices of OpenAI to discuss what would be left for humans to do when artificial intelligence becomes superhuman at math.

CISOs are struggling to threat-model AI. Can 15-minute sessions help?

www.csoonline.com · 2 months ago

A few weeks ago, on a busy day, threat-modeling expert Adam Shostack opened an email from a client. Someone at that organization had vibe-coded an app and put it to work with customer data. Now, the client wanted to know what risks the tool posed. And what it should do about them. They needed answers quickly, so Shostack gave himself 15 minutes to analyze the system.

Chrome, Firefox Updates Patch Dozens of Vulnerabilities

www.securityweek.com · 2 months ago

The bugs could lead to code execution, privilege escalation, sandbox escape, and information disclosure.

Microsoft Links 30+ Domains to MacSync Stealer’s Credential-Theft and Data-Exfiltration Infrastructure

gbhackers.com · 2 months ago

More than 30 domains tied to MacSync Stealer, exposing a rotating macOS-focused infrastructure that supports payload delivery, command-and-control, credential theft, staging, and chunked data exfiltration. The investigation shows why defenders should prioritize repeatable endpoint and network behavior over static domain-based detections.

CISA: Medusa ransomware hit over 500 critical infrastructure orgs

www.bleepingcomputer.com · 2 months ago

The FBI said Tuesday that the Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021.

D-Link DWR-M961 Router Hit by 15 Command Injection and Buffer Overflow Vulnerabilities

gbhackers.com · 2 months ago

D-Link has disclosed and patched 15 Common Vulnerabilities and Exposures (CVEs) affecting its DWR-M961 4G/LTE router, specifically hardware revision C1. This follows the discovery of multiple command injection and buffer overflow vulnerabilities in the device’s web management components. These vulnerabilities affect non-US DWR-M961 devices running firmware versions 1.1.

RAVEN Tool Steals Entire Elasticsearch Databases and Rebuilds Deleted Backdoors

gbhackers.com · 2 months ago

The RAVEN offensive framework can turn compromised Elasticsearch and Kibana environments into durable data-theft and persistence operations. RAVEN, short for Reconnaissance & Attack on Vulnerable Elasticsearch Nodes, is an open-source modular framework built to assess Elasticsearch and Kibana security posture across reconnaissance, exploitation, exfiltration, persistence, and cleanup workflows.

Critical Apache HttpComponents Client Flaw Lets Attackers Impersonate Servers

gbhackers.com · 2 months ago

A critical vulnerability in the Apache HttpComponents Client can allow man-in-the-middle attackers to impersonate trusted servers when applications use the asynchronous version of HttpClient. This vulnerability is tracked as CVE-2026-71290 and arises from improper TLS hostname verification in Apache HttpComponents Client versions 5.4 through 5.6.3.

Prison for data analyst who tried to extort $2.5 million from his employer

www.bitdefender.com · 2 months ago

When Cameron Curry discovered that his contract as a data analyst wasn't going to be renewed, he could have updated his LinkedIn profile. He could have started sending out his resume. But what the 27-year-old from Charlotte, North Carolina, did instead was turn to extortion. Read more in my article on the Hot for Security blog.

CareCloud Data Breach Impact Grows to 3.7 Million Individuals

www.securityweek.com · 2 months ago

The data breach was initially believed to affect roughly 350,000 people, but the HHS breach tracker shows a far bigger impact.

CISA Warns Hackers Are Actively Exploiting VMware vCenter Path Traversal Flaw

gbhackers.com · 2 months ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting Broadcom VMware vCenter to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability, tracked as CVE-2026-59310, is a path traversal flaw that enables arbitrary code execution in affected vCenter deployments.

Fake Claude Install Guide Steals Mac Passwords and Turns Trusted Crypto Wallet Apps Into Phishing Traps

gbhackers.com · 2 months ago

A Google-sponsored search result for Claude installation instructions is being used to deliver a sophisticated macOS stealer and remote-access trojan (RAT) named MacSync. The campaign abuses a legitimate Claude shared-conversation page on the claude.ai domain, demonstrating how trusted AI-hosting infrastructure can be weaponized to bypass users’ normal phishing instincts.

Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure

thehackernews.com · 2 months ago

Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating recurring endpoint and network behaviors across changing infrastructure, tracing the malware from payload retrieval through data collection, staging, and exfiltration.

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

thehackernews.com · 2 months ago

A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management (PLM) software, according to new findings from ReliaQuest.

Hackers Abuse Thousands of WordPress Sites to Spread StopAndProtect Malware via ClickFix

gbhackers.com · 2 months ago

A large-scale malware operation called StopAndProtect is exploiting thousands of compromised WordPress websites to distribute ransomware, steal files, harvest credentials, and remotely monitor victims through deceptive ClickFix CAPTCHA prompts. Researchers first identified the campaign in mid-May 2026.

Cl0p Hackers Exploit PTC Windchill Vulnerability to Deploy Custom Web Shell and Steal Data

gbhackers.com · 2 months ago

The Cl0p ransomware and extortion operation is likely exploiting a critical PTC Windchill vulnerability to deploy a purpose-built Java web shell that can harvest credentials, map engineering data vaults, and exfiltrate files without requiring additional attacker tooling. Tracked as CVE-2026-12569, the vulnerability is a CVSS 9.

Medusa Ransomware Attacks 300+ Critical Infrastructure Organizations Using Double Extortion

gbhackers.com · 2 months ago

Medusa ransomware operators have compromised over 500 organizations across critical infrastructure sectors, according to a joint advisory issued by the FBI, CISA, and the U.S. Department of Health and Human Services (HHS) as part of their StopRansomware initiative.

Critical Microsoft Copilot CoSnitch Flaw Lets Hackers Steal Sensitive Data With One Click

gbhackers.com · 2 months ago

A critical one-click vulnerability in Microsoft Copilot Personal, tracked as CVE-2026-24301 and dubbed CoSnitch. This flaw could enable an attacker to trigger malicious Copilot prompts, access data from connected OAuth applications, and silently transmit that information to an attacker-controlled server.

The Curious Incidents with DNS in the Sandbox at Escape-Time

chasersystems.com · 2 months ago

Three variations on subversive use of DNS by the Agent are documented in Hugging Face's technical writeup of the July 2026 security incident involving OpenAI models. In this article, I discuss what each of these three types of DNS workarounds achieve in practice, the constraints an actor might have faced to attempt a particular one, and additional benefits from choosing each.

Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it

www.csoonline.com · 2 months ago

Almost eight months after confirming a critical security vulnerability within the personal version of its AI assistant, Copilot, Microsoft on Tuesday issued a patch to close the hole, which relies on an LLM’s inability to distinguish the data in a query from an instruction.

China-Linked Hacker Shows AI Capabilities in APAC Attack

www.darkreading.com · 2 months ago

In the first purported "near-autonomous" attack on a nation-state, a Chinese-language operator used a complex AI framework to target and compromise government agencies, likely in Taiwan.

SVD-2026-0801: Security Hardening Release for Splunk Enterprise - August 2026