Blahalla

Microsoft confirms Windows 11 security update install issues

www.bleepingcomputer.com · 2 months ago

The May 2026 Windows 11 security update KB5089549 fails to install on some systems, triggering 0x800f0922 errors and rolling back during reboot at about 35 to 36 percent. The problem is caused by insufficient free space on the EFI System Partition, particularly when about 10 megabytes or less remain, and logs show SpaceCheck insufficient free space, ServicingBootFiles failed error 0x70, and third party or OEM files using ESP space outside Microsoft boot directories. Mitigations include using Known Issue Rollback and, in enterprise environments, installing and configuring the supplied Group Policy and restarting devices to temporarily disable the change causing the issue.
n8n Security Flaws Could Let Attackers Achieve Remote Code Execution

gbhackers.com · 2 months ago

Critical vulnerabilities in the n8n workflow automation platform allow attackers with low privilege authenticated access to chain multiple flaws and achieve full remote code execution. The issues are tracked as CVE-2026-44789 affecting the HTTP Request node via prototype pollution, CVE-2026-44790 affecting the Git node allowing arbitrary file read through argument injection, and CVE-2026-44791 which bypasses a prior XML node patch and enables prototype pollution. n8n has released patches and advises upgrading to versions 1.123.43 or later, 2.20.7 or later, and 2.22.1 or later, and recommends restricting workflow creation and disabling vulnerable nodes where immediate patching is not possible.
OtterCookie Malware Steals Dev Secrets, SSH Keys, Cloud Credentials, and Tokens

gbhackers.com · 2 months ago

OtterCookie is a separate Node.js based remote access trojan that maintains persistent Socket.IO connections using Engine.IO v4 to monitor infected developer workstations in real time rather than relying on one time harvests. It continuously captures clipboard contents, keystrokes, screenshots, browser credentials, crypto wallet data, SSH keys, environment files, cloud credentials, and API tokens, and its infrastructure broadcasts live rosters of infected machines from servers including a Hetzner host at 195.201.104.53 with observed campaign IDs 902 to 906. The campaign spread through malicious npm packages and Vercel hosted payloads, with researchers attributing about 197 malicious packages and roughly 31,000 downloads during a late 2025 wave, and identifiers labeled uid and userKey appear to represent campaign batches rather than unique devices which can still link infections to specific waves.
Fast16 Malware Sabotages Nuclear Test Simulations by Altering Data

gbhackers.com · 2 months ago

Fast16 is a cyber‑espionage framework that sabotages nuclear weapons simulations by silently altering critical test data, using a highly selective hook engine to modify application behavior in real time and activating only under precise conditions tied to detonation modeling. It targets physics engines LS-DYNA and AUTODYN and manipulates outputs when material density exceeds thirty grams per cubic centimeter, employing three tampering mechanisms that can reduce calculated values to as little as one percent or scale pressure outputs down as much as forty two percent depending on version and parameters. The framework spreads laterally via shared drives and credential impersonation, maintains persistence with a kernel‑level driver and Image File Execution Options hijacking while avoiding systems with known security tools, and includes multiple tailored builds dating back to around two thousand five, prompting recommendations to monitor and audit kernel drivers, enforce strict application control, deploy advanced endpoint detection, and regularly validate simulation outputs against independent models.
Exploitation of Critical NGINX Vulnerability Begins

www.securityweek.com · 2 months ago

There are active in the wild attacks exploiting a critical NGINX heap buffer overflow tracked as CVE-2026-42945 and dubbed Nginx Rift, a flaw in the ngxhttprewritemodule that has existed for 16 years. The vulnerability can be exploited remotely without authentication via crafted HTTP requests when a specific rewrite configuration is present, causing a denial of service on default deployments and enabling remote code execution if Address Space Layout Randomization is disabled. Public proof of concept code appeared shortly after F5 released patches, and researchers observed exploitation on honeypots while estimating about 5.7 million internet exposed NGINX servers run potentially vulnerable versions though the truly exploitable subset is smaller. Organizations are urged to apply the available patches from F5 and review rewrite configurations to mitigate the issue.
Exploit available for new DirtyDecrypt Linux root escalation flaw

www.bleepingcomputer.com · 2 months ago

There is a recently patched local privilege escalation vulnerability in the Linux kernel rxgk module named DirtyDecrypt also known as DirtyCBC and a proof of concept exploit is now available that can grant attackers root access on some Linux systems. The flaw aligns with CVE-2026-31635 which was patched on April 25, 2026 and affects kernels built with the CONFIGRXGK option enabled, limiting impact primarily to distributions that closely follow mainline kernels such as Fedora Arch and openSUSE Tumbleweed. Users should install the latest kernel updates immediately or temporarily mitigate the risk by disabling the esp4 esp6 and rxrpc kernel modules understanding that this will break IPsec VPNs and AFS network file system functionality.
Linux Torvalds Warns AI Bug Report Spam Is Disrupting Linux Security Discussions

gbhackers.com · 2 months ago

Linus Torvalds warned that a flood of low value AI generated bug reports is overwhelming the private Linux security mailing list and disrupting real security work. Linux 7.1 security documentation now instructs that bugs found by AI or mass scanning tools should generally be treated as public unless they meet strict security criteria, and that reporters must add human value by verifying issues on a recent kernel, providing a tested reproducer, and proposing and testing patches. The guidance narrows private reporting to urgent issues that grant attackers unintended capabilities on correctly configured production systems, requests plain text concise reports, and warns against posting full exploit code publicly while encouraging responsible use of AI as a starting point rather than a finished report.
1 Million WordPress Websites Exposed by Avada Builder Security Vulnerabilities

gbhackers.com · 2 months ago

More than one million WordPress sites using Avada Builder were exposed to two vulnerabilities that allow arbitrary file reads and time based SQL injection. The flaws are tracked as CVE-2026-4782, an arbitrary file read affecting versions up to 3.15.2 that can let low level authenticated users retrieve files such as wp config php, and CVE-2026-4798, a high severity time based SQL injection affecting versions up to 3.15.1 that can be exploited by unauthenticated attackers when WooCommerce was previously installed and then deactivated. Wordfence released firewall protections for premium users on March 25, 2026 and for free users on April 24, 2026 while Avada released a partial fix on April 13, 2026 and a complete patch in version 3.15.3 on May 12, 2026. Administrators are urged to update to Avada Builder version 3.15.3 immediately to prevent data theft or full site compromise.
Pre-Stuxnet Fast16 Malware Tampered with Nuclear Weapons Simulations

thehackernews.com · 2 months ago

A new analysis confirms fast16 was a Lua based industrial sabotage malware engineered to tamper with uranium compression simulations used in nuclear weapons design. Researchers found fast16 hooks into LS DYNA and AUTODYN and enforces 101 tampering rules grouped to target different software builds, activating only during full scale blast and detonation runs and when simulated material density exceeds 30 grams per cubic centimeter. The malware spreads across local networks, avoids machines with certain security products, and appears to have been developed as early as 2005, predating known Stuxnet variants and indicating nation state level expertise.
Critical FunnelKit Vulnerability Puts 40,000+ WooCommerce Sites at Risk

gbhackers.com · 2 months ago

There is a critical vulnerability in FunnelKit’s Funnel Builder plugin that is being actively exploited, putting more than 40,000 WooCommerce sites at risk of payment data theft; the flaw affects all Funnel Builder versions prior to 3.15.0.3 and allows unauthenticated injection of arbitrary JavaScript into checkout pages. The issue stems from an insecure public checkout endpoint that permits requests to invoke internal methods without validating permissions, enabling attackers to alter the External Scripts setting and insert malicious script tags that execute on every checkout page. Observed campaigns disguise skimmers as legitimate analytics or Google Tag Manager code, use base64-encoded payloads to load external scripts, and establish WebSocket connections to retrieve and run payment skimmers that intercept and exfiltrate card numbers, CVVs, and billing details in real time. Immediate mitigations include updating Funnel Builder to version 3.15.0.3 or later, auditing and removing unfamiliar entries from the External Scripts setting, scanning sites with tools such as eComscan, and monitoring checkout behavior and logs for unauthorized changes.
Autonomous AI Penetration Testing with Consent-First Ethical Framework — Research Paper + Working Implementation

doi.org · 2 months ago

NULL
Crafted JPEGs Could Trigger PHP Memory Bugs for Exploitation

gbhackers.com · 2 months ago

There are two memory safety flaws in PHP's ext/standard image-handling functions: a heap memory disclosure in getimagesize() and a heap buffer overflow in iptcembed(). The getimagesize() issue, tracked as CVE-2025-14177 with a CVSS score of 6.3, is caused by improper handling of chunked reads of large JPEG APP segments that can overwrite buffer beginnings and leave tails uninitialized, enabling sensitive heap data leakage. The iptcembed() flaw results from allocating buffers based on fstat reported sizes while reading until EOF, allowing writes beyond allocated memory as demonstrated via FIFO streaming; both bugs have been patched by advancing buffer pointers and adding strict bounds checking, and teams are advised to validate image inputs, limit file sizes, and update PHP.
Hackers earn $1,298,250 for 47 zero-days at Pwn2Own Berlin 2026

www.bleepingcomputer.com · 2 months ago

The Pwn2Own Berlin 2026 contest concluded with security researchers collecting $1,298,250 after exploiting 47 zero-day flaws. The event ran at OffensiveCon from May 14 to May 16 and targeted fully patched web browsers, enterprise applications, local privilege escalation, servers, local inference, cloud native and container environments, virtualization, and large language model categories. DEVCORE won with 50.5 Master of Pwn points and $505,000 in rewards after chaining exploits against Microsoft SharePoint, Microsoft Exchange, Microsoft Edge, and Windows 11, while Cheng Da Tsai received the highest single prize of $200,000 for chaining three bugs to achieve remote code execution with SYSTEM privileges on Microsoft Exchange. Vendors will have 90 days to issue patches before the Zero Day Initiative publicly discloses the flaws.
Grafana Labs Confirms Security Incident Involving GitHub Codebase Access

gbhackers.com · 2 months ago

Grafana Labs confirmed on May 17, 2026 that an unauthorized party obtained a compromised access token, accessed the company’s internal GitHub environment, and downloaded portions of the codebase. The company reported the breach was limited to its code environment with no evidence of customer data access or impact on customer systems, and it invalidated the token and launched a forensic investigation. The threat actor attempted to extort Grafana by threatening to release the stolen code, and Grafana refused to pay following FBI guidance against ransom payments. The incident highlights the risk posed by leaked credentials, the exposure of proprietary code for future vulnerability discovery, and the need for stricter credential management and repository monitoring.
Researchers Build First Public Apple M5 macOS Kernel Exploit with Mythos Preview

gbhackers.com · 2 months ago

Security researchers unveiled the first public macOS kernel memory corruption exploit targeting Apple M5 silicon that bypasses Memory Integrity Enforcement and compromises macOS 26.4.1 build 25E253 to achieve a full kernel compromise. The data only exploit starts from an unprivileged local user, uses only legitimate system calls to manipulate kernel memory structures and escalate to root while avoiding traditional code execution techniques, and it was developed using the AI assisted research system Mythos Preview with human refinement to bypass hardware mitigations. The team disclosed the findings to Apple in person on May 14, 2026, is holding technical details under embargo pending patches, and plans to publish a 55 page technical report after fixes are released, underscoring that hardware backed mitigations are not absolute as AI accelerates exploit discovery.
Malicious npm Packages Steal SSH Keys, Cloud Credentials, and Crypto Wallets

gbhackers.com · 2 months ago

A new supply chain attack in the npm ecosystem is stealing developer secrets by delivering infostealer malware through four malicious packages that collectively recorded over 2,600 weekly downloads. One package contains a near identical clone of the recently leaked Shai Hulud malware that harvests credentials, cryptocurrency wallets, and environment variables and exfiltrates them to attacker controlled servers. Other packages harvest SSH keys, cloud credentials for AWS, Google Cloud, and Azure, collect system and geolocation data, and one deploys a Go based phantom bot that establishes persistence and can turn infected machines into nodes for distributed denial of service attacks. Developers are advised to uninstall the packages, rotate any potentially exposed credentials, and scan for indicators such as the string A Mini Sha1 Hulud has Appeared to identify compromised environments.
Claude Code Vulnerability Allows Attackers to Run Commands Through Crafted Deeplinks

gbhackers.com · 2 months ago

A recently disclosed flaw in Claude Code allowed attackers to execute arbitrary system commands by invoking a single crafted deeplink, turning a convenience feature into a remote code execution vector. The issue was documented by security researcher Joernchen and has been fixed in Claude Code version 2.1.118. The vulnerability demonstrates how subtle command line interface parsing mistakes can enable remote code execution and highlights the risk of deeplink handling in developer tools.
Hackers Earn $1.3 Million at Pwn2Own Berlin 2026

www.securityweek.com · 2 months ago

Participants at Pwn2Own Berlin 2026 earned nearly 1.3 million dollars for demonstrating exploits across Windows, Linux, VMware, Nvidia, and multiple AI products. TrendAI’s Zero Day Initiative awarded 1,298,250 dollars for 47 unique vulnerabilities, with Devcore and StarLabs SG claiming nearly 750,000 dollars between them and the largest single payouts being 200,000 dollars for a Microsoft Exchange remote code execution and 200,000 dollars for a VMware ESX cross tenant code execution exploit. AI targets drew numerous rewards for hacks against LiteLLM, OpenAI Codex, LM Studio, Claude Code, NVIDIA Megatron Bridge, Chroma, and Ollama, while other bounties ranged from 2,500 dollars to 50,000 dollars for Red Hat Linux, Windows 11, NVIDIA components, and VMware. Eight attempts failed and some researchers who could not register disclosed their findings directly to vendors or began public disclosures.
Can Laws Stop Deepfakes? South Korea Aims to Find Out

www.darkreading.com · 2 months ago

There will be local elections in South Korea on June 3, 2026, and authorities will for the first time enforce two laws intended to curb AI generated deepfakes in political campaigns. Article 82-8 of the Public Official Election Act prohibits virtual sounds images and videos that are difficult to distinguish from reality for 90 days before an election and carries penalties of up to seven years imprisonment or fines between 10 million and 50 million Korean won. The AI Basic Act, effective January 2026, requires AI operators to clearly disclose generated content and allows administrative fines up to 30 million Korean won, and the National Police Agency has deployed a deepfake detection tool. Experts warn that regulation alone is unlikely to stop harm because deepfakes spread rapidly through encrypted messaging and other channels, so platform accountability detection infrastructure and media literacy are still needed.
New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released

www.bleepingcomputer.com · 2 months ago

A proof of concept exploit named MiniPlasma was released by a researcher called Chaotic Eclipse and allows local attackers to gain SYSTEM privileges on fully patched Windows systems. The exploit targets the cldflt.sys Cloud Filter driver and its HsmOsBlockPlaceholderAccess routine by abusing registry key creation through an undocumented CfAbortHydration API, reproducing a flaw originally reported to Microsoft by James Forshaw in September 2020 that was assigned CVE-2020-17103 and reportedly fixed in December 2020. Testing on a fully patched Windows 11 Pro system showed the exploit opened a SYSTEM command prompt, and independent analysis confirmed it works on current public Windows 11 builds but not on the latest Insider Canary build. The disclosure is part of a recent series of Windows zero day releases by the same researcher that include BlueHammer tracked as CVE-2026-33825 and other exploits.
Ansible security and compliance guide

slicker.me · 2 months ago

There are security architecture priorities for Ansible that recommend running the control node on a dedicated hardened bastion, restricting ansible.cfg permissions, pinning Ansible and collection versions, and tightly managing SSH keys with modern algorithms such as Ed25519. There are guidance and examples for secrets management that advise using Ansible Vault for repository encryption, separating secrets with multiple vault IDs, avoiding passing secrets via extra vars, and preferring runtime secret retrieval from dedicated secret managers via lookup plugins. There are privilege escalation controls emphasizing least privilege by default, limiting become usage to necessary tasks, restricting sudoers to specific commands, and using becomeuser to escalate to service accounts rather than root. There are recommendations to automate OS hardening and compliance with community collections and OpenSCAP, to run static analysis and CI gates with ansible-lint and Molecule, and to enforce RBAC and credential isolation in Automation Controller to reduce exposure.
Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing

www.bleepingcomputer.com · 2 months ago

Tycoon2FA now supports device code phishing and abuses Trustifi click tracking URLs to hijack Microsoft 365 accounts. Attackers obtain an OAuth device code, trick victims into entering it in Microsoft’s legitimate device login flow, then receive access and refresh tokens that register an attacker controlled device and grant unrestricted access to email calendar and cloud storage. The kit rebounded after a March takedown and now uses multiple obfuscation and anti analysis layers including a large vendor blocklist and redirects to legitimate pages for analysis environments, and defenders are advised to disable the OAuth device code flow when not needed restrict OAuth consent require admin approval for third party apps enable Continuous Access Evaluation and monitor authentication logs.
NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE

thehackernews.com · 2 months ago

A heap buffer overflow in the ngxhttprewritemodule impacting NGINX Open and NGINX Plus versions 0.6.27 through 1.30.0 is being actively exploited in the wild and is tracked as CVE-2026-42945 with a CVSS score of 9.2. Successful exploitation can crash worker processes and may yield remote code execution, but reaching RCE requires a specific NGINX configuration and systems with Address Space Layout Randomization disabled, making RCE nontrivial in default deployments while the worker-crash denial of service remains an urgent risk. Threat intelligence also shows attacks targeting openDCIM flaws including CVE-2026-28515, CVE-2026-28517, and the related CVE-2026-28516, which can be chained to achieve remote code execution and have been probed by automated scanning that drops web shells.
Instrumenting QT6 desktop apps with Frida - Part 2: Building the Bypass Chain

blog.samanl33t.com · 2 months ago

There are three bypasses demonstrated against a Qt6 desktop app called HackPass using Frida: enabling premium features without a license, bypassing TLS pinning by turning on TOFU re-learning, and disabling the app hardening subsystem. The author shows Frida helper scripts that scan process memory for QObject instances, call QINVOKABLE methods such as setPremium and setAllowTofuLearning, and write QPROPERTY values via Qt's qtmetacall to flip the hardening enabled flag. A single chain script runs the sequence end to end, but the TLS bypass also requires clearing the app's stored TOFU certificate so the re-learn can pin a proxy certificate, and the premium flip is temporary unless repeated because the backend re-evaluates license status.
Grafana GitHub Token Breach Led to Codebase Download and Extortion Attempt

thehackernews.com · 2 months ago

An unauthorized party obtained a token that allowed access to Grafana's GitHub environment and enabled downloading of the company's codebase. Grafana's investigation found no customer data or personal information was accessed and reported no evidence of impact to customer systems or operations. The attacker attempted to extort the company by threatening to publish the stolen data, and Grafana declined to pay while involving the Federal Bureau of Investigation, invalidating the compromised credentials and implementing additional security measures. Reports indicate a group calling itself CoinbaseCartel claimed responsibility and is described as a data extortion crew linked to ShinyHunters Scattered Spider and LAPSUS, but Grafana did not disclose when the incident occurred or which repositories were accessed.
Microsoft rejects critical Azure vulnerability report, no CVE issued

www.bleepingcomputer.com · 2 months ago

A researcher reported a critical privilege escalation in Azure Backup for AKS that allowed a user with only the Backup Contributor role to gain cluster administrator privileges and extract secrets or restore malicious workloads. Microsoft rejected the report saying the behavior required pre existing administrative privileges and that no product changes or CVE were issued, while CERT validated the issue and assigned tracking identifier VU 284781. After disclosure the original attack path stopped working and additional permission checks were observed, indicating the issue appears silently fixed without a public advisory which leaves defenders without clear visibility into exposure and remediation timelines.
Canvas hack: is it ever a good idea to pay a ransom, and what happens to the data?

www.theguardian.com · 2 months ago

Instructure, operator of the Canvas education platform, said it reached an agreement with the unauthorised actor responsible for a ransomware attack that caused widespread outages and service disruptions for schools worldwide. The hacking group ShinyHunters claimed responsibility and threatened to leak a reported 3.6 terabytes of data containing student ID numbers, email addresses, names and messages from about 9,000 schools and an estimated 275 million students and staff, and experts read the language of the agreement as indicating a ransom was likely paid though the company has not confirmed payment. Instructure said the data was returned and it was shown digital confirmation of destruction via shred logs, while cybersecurity experts warn that paying attackers may not prevent further exposure and that governments advise against making ransom payments.
Funnel Builder Flaw Under Active Exploitation Enables WooCommerce Checkout Skimming

thehackernews.com · 2 months ago

There is a critical vulnerability in the Funnel Builder WordPress plugin that is being actively exploited to inject malicious JavaScript into WooCommerce checkout pages to steal payment card numbers, CVVs, billing addresses, and other checkout data. The flaw affects all Funnel Builder versions before 3.15.0.3 and is present on more than 40,000 WooCommerce stores, allowing unauthenticated attackers to call a publicly exposed checkout endpoint that can invoke internal methods without permission checks and write attacker controlled code into the plugin settings. Attackers have been planting scripts disguised as Google Tag Manager that load remote skimmers and open WebSocket connections to attacker command and control servers to retrieve tailored skimming payloads. A patch was released in version 3.15.0.3 and site owners are urged to update and review their checkout external scripts settings, and the vulnerability currently does not have an official CVE identifier.
AI-assisted cyberattacks are changing the threat landscape faster than most organizations realize.

www.qihhub.com · 2 months ago

AI assisted cyberattacks are changing the threat landscape faster than most organizations realize. Attackers are using AI generated phishing, voice cloning, deepfake impersonation, automated reconnaissance, and adaptive malware behavior, and scalability now lets small threat actors operate with capabilities that previously required highly organized teams. Defensive systems must evolve from reactive monitoring to predictive intelligence because cybersecurity in 2026 is becoming a competition of intelligence speed and organizations that fail to adapt early may struggle to respond later.
Russian hackers turn Kazuar backdoor into modular P2P botnet

www.bleepingcomputer.com · 2 months ago

The Russian hacker group Secret Blizzard has developed the long running Kazuar backdoor into a modular peer to peer botnet engineered for long term persistence, stealth, and data collection. The malware now consists of three modules named Kernel, Bridge, and Worker, with an internally elected Kernel leader that communicates externally through the Bridge to reduce visible traffic and improve stealth. The Worker module carries out espionage functions including keylogging, screenshots, filesystem and email harvesting, system and network reconnaissance, and stages encrypted data locally for later exfiltration via the Bridge. Kazuar supports about one hundred fifty configuration options and security bypasses such as AMSI, ETW, and WLDP, and defenders are advised to prioritize behavioral detection over static signatures.
Microsoft MDASH found 16 Windows RCEs — here's exactly how the 100-agent pipeline works

www.revolutioninai.com · 2 months ago

Microsoft's MDASH Multi-Model Agentic Scanning Harness coordinates over 100 specialized AI agents in a five-stage pipeline, Prepare, Scan, Validate, Dedup, Prove, to locate, debate, validate, collapse duplicates of, and produce working proof-of-concept exploits for software vulnerabilities, and the system is model-agnostic so models can be swapped via configuration. MDASH scored 88.45 percent on the CyberGym benchmark, beating Anthropic's Mythos Preview at 83.1 percent and OpenAI's GPT-5.5 at 81.8 percent, and demonstrated high historical recall on Windows components and perfect recall in a private driver test. The system discovered 16 previously unknown Windows vulnerabilities including four critical remote code execution flaws patched in the May 2026 Patch Tuesday; two named CVEs are CVE-2026-33827, a tcpip.sys use-after-free reachable remotely via crafted IPv4 packets, and CVE-2026-33824, an IKEEXT double-free triggered by two specially crafted UDP packets that can run as LocalSystem. MDASH is in limited private preview with Microsoft and a few external customers, and the same publicly available architecture could be reproduced by well-resourced adversaries, narrowing the gap between defender and attacker speed.
JDownloader Website Hack Exposes Windows and Linux Users to Malicious Installers

gbhackers.com · 2 months ago

Between May 6 and May 7 2026 attackers gained unauthorized access to the JDownloader project's website and replaced official installers with trojanized versions, exposing Windows and Linux users to malicious downloads. The compromise affected Windows Alternative Installer downloads and Linux shell installer scripts and delivered a Python based remote access trojan capable of persistent access, command execution, and data theft. Investigators attribute the breach to an unpatched content management system vulnerability that allowed modification of access control lists and download links without authentication, and developers confirmed the breach on May 7 2026 before restoring clean downloads on May 8 and May 9 2026. Users who downloaded installers during the impacted period are advised to verify installer hashes, scan systems with updated antivirus or EDR, remove suspicious files, and reinstall from verified sources.
PoC Code Published for Critical NGINX Vulnerability

www.securityweek.com · 2 months ago

There is a critical heap buffer overflow in the ngxhttprewritemodule tracked as CVE-2026-42945 with a CVSS score of 9.2 that was introduced in 2008 and patched on May 16, 2026 in NGINX Plus and NGINX open source. The flaw can trigger a restart causing denial of service and can enable remote code execution when Address Space Layout Randomization is disabled. Technical details and proof of concept exploit code show the bug stems from a two pass script engine used by rewrite and set directives where a replacement containing a question mark leads to an undersized buffer allocation and attacker controlled overflow, and F5 patched NGINX Plus versions 37.0.0 R36 P4 and R32 P6 and open source versions 1.31.0 and 1.30.1.
He’s king of the AI boom. Why do former colleagues say he can’t be trusted?

www.washingtonpost.com · 2 months ago

There has been testimony in Elon Musk's federal lawsuit alleging that OpenAI CEO Sam Altman misled colleagues and renewed broader questions about his honesty. Several former OpenAI executives and board members testified that Altman was untruthful, citing his abrupt ouster in November 2023, deposition videos alleging a pattern of lying, and disclosures in court that he held one point six five billion dollars in a fusion company tied to OpenAI and interests in a fund that owns OpenAI shares. Musk seeks to remove Altman and OpenAI president Greg Brockman and restore the company to a nonprofit, while OpenAI denies the claims and members of Congress and multiple state attorneys general have asked regulators to review potential conflicts.
Linux “ssh-keysign-pwn” Flaw Exposing Critical Authentication Files

gbhackers.com · 2 months ago

A newly disclosed Linux kernel vulnerability called ssh-keysign-pwn allows unprivileged local users to read root owned files, including SSH host private keys and password hashes stored in the system shadow file. The issue stems from a six year old logic bug in the kernel's ptrace access checks that can lift open file descriptors from a terminating privileged process and affects SUID helpers such as ssh-keysign and chage. The flaw is tracked as CVE-2026-46333, was reported by Qualys and patched upstream with a fix applied on May 14, 2026, and the vulnerability was published to the National Vulnerability Database on May 15, 2026. Distributions and vendors are issuing kernel updates and mitigations like tightening ptrace scope while operators are advised to apply updates promptly and rotate any exposed SSH host keys and password hashes if compromise is suspected.
Friday Squid Blogging: Bigfin Squid

www.schneier.com · 2 months ago

An overview of the bigfin squid is presented, accompanied by an invitation to discuss security stories not covered and a note about the blog moderation policy. The post was published on May 15, 2026.
OpenAI Bought Company That Offered A.I. Tools for Cloning Voices

www.nytimes.com · 2 months ago

OpenAI acquired Weights GG, a social network used to create and share artificial intelligence algorithms. The acquisition is linked to OpenAI's push into voice cloning and gives the company access to a community of user created models, raising questions about how those models and user data will be managed.
Expired domain leads to supply chain attack on node-ipc npm package

www.csoonline.com · 2 months ago

There are trojanized versions 9.1.6, 9.2.3 and 12.0.1 of the popular npm package node-ipc that include an obfuscated 80 kilobyte credential stealing payload inside node-ipc.cjs. There are extensive credential collection routines that search for cloud provider and CI CD configuration files, SSH keys, Kubernetes and Docker material, npm and Git credentials, Terraform and dot env files, macOS keychain and Linux keyrings, and other secrets, then archive the data and exfiltrate it by issuing DNS TXT queries to an attacker controlled domain. There are indications the compromise resulted from attackers re registering a maintainer's expired custom email domain, which expired in January 2025 and was re registered in May 2026, allowing them to recreate the maintainer address and reset the npm account to publish the malicious releases, and the package's use as a dependency by hundreds of projects gives the incident a large blast radius. There are immediate recommendations to scan systems for the affected versions, treat any stored access tokens, environment variables, and API keys on infected machines as compromised, rotate secrets, and deploy detections using published file hashes and indicators of compromise.
Congress Puts Heat on Instructure After Canvas Outage

www.darkreading.com · 2 months ago

Lawmakers from the House Committee on Homeland Security have demanded that Instructure appear for a briefing after the Canvas learning management system was breached twice in one week by the ShinyHunters group, leaving thousands of schools unable to report grades and access other functions. Instructure disclosed an initial breach on May 1 that exposed names, emails, student ID numbers, and private messages, and ShinyHunters claimed to possess more than three terabytes of data from over nine thousand educational institutions before the attackers returned and posted a ransom demand the following day. The company said it reached an agreement with the threat actor and asserted that the stolen data was returned and confirmed destroyed while not admitting payment, and both House and Senate committees are probing whether a ransom was paid and whether the incident is linked to a September 21, 2025 Salesforce compromise, with the House requesting a meeting no later than May 21.
Apple Maildrop lets you rewrite the filename, size, and icon on any icloud.com attachment link — no signature, no validation — reported July 2023, still live

stuart-thomas.com · 2 months ago

There is a public disclosure named MAILDROP-01 showing that Apple’s Maildrop attachment service generates URLs with three unsigned, client controlled parameters called f, sz and uk, where f sets the filename shown and is interpolated into the CDN download path, sz sets the file size shown, and uk is a user key that is not bound to the other parameters. By changing f and sz and sharing the link, the landing page will display the chosen filename and file size and infer the icon from the chosen extension, while the CDN serves the file so it is downloaded using the chosen filename, all on Apple’s domain with no visual indicator that the metadata is sender controlled. The issue was reported on 7 July 2023 and as of 8 April 2026 the vendor marked it prioritised for review with no remediation deployed, a lapse of 34 months.
Exchange Server zero-day vulnerability can be triggered by opening a malicious email

www.csoonline.com · 2 months ago

A newly discovered zero day cross site scripting vulnerability in Microsoft Exchange Outlook Web Access can be triggered by a specially crafted email that, when opened under certain interaction conditions, allows arbitrary JavaScript execution and can be used to read or send email, tracked as CVE-2026-42897 and affecting Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition while Exchange Online is unaffected. Microsoft has published an automatic mitigation via the Exchange Emergency Mitigation Service which should be enabled immediately, and administrators who cannot use that service must apply the Exchange on premises Mitigation Tool by running its script, noting that servers older than March 2023 cannot check for new mitigations via the EM Service. Known side effects of the mitigation include broken OWA calendar printing, inline images not displaying in the OWA reading pane, and OWA light not working, and Microsoft says security updates will be released in the future for Exchange SE RTM, Exchange 2016 CU23, and Exchange 2019 CU14 and CU15 while organizations on older cumulative updates are urged to upgrade now.
Vibe Coding Cheat Sheet: Tools, Prompts, Security Tips, and More

www.techrepublic.com · 2 months ago

Vibe coding turns plain English into working applications through a conversational feedback loop where a user states a high level intent, the AI drafts code, the user runs it, and then the AI and user iterate until it works, a term coined by Andrej Karpathy in early 2025. There are techniques from pure vibe coding for rapid prototypes to responsible AI assisted development where humans review and test every chunk, and the approach is best for prototyping, boilerplate, small automation, and solo projects but breaks down for large, stateful, or security critical systems. Security risks are significant with a cybersecurity firm finding roughly 380,000 publicly accessible assets created with vibe coding tools and about 5,000 of those apps leaking sensitive data including medical and financial records, so human oversight is essential. Recommended mitigations include planning in markdown, using specific three layer prompts, running and testing code locally, never hardcoding secrets, validating and sanitizing inputs, auditing dependencies, running static and dynamic scans, and requiring human code review before shipping.
Funnel Builder WordPress plugin bug exploited to steal credit cards

www.bleepingcomputer.com · 2 months ago

There is a critical unauthenticated vulnerability in the Funnel Builder WordPress plugin that is being actively exploited to inject malicious JavaScript into WooCommerce checkout pages. Attackers exploit an unprotected, publicly accessible checkout endpoint to modify the plugin's global settings and add arbitrary scripts to its External Scripts setting, delivering a payment card skimmer that steals credit card numbers, CVVs, billing addresses and other customer information. The payload masquerades as an analytics tag and opens a WebSocket to an attacker controlled server to exfiltrate data, and the vendor released version 3.15.0.3 on May 14, 2026 to address the issue while advising administrators to update immediately and review checkout external scripts for rogue entries.
A Start-Up Aiming to Make Geothermal Energy Mainstream Goes Public

www.nytimes.com · 2 months ago

Fervo Energy raised about 1.9 billion dollars in an upsized initial public offering by selling 70 million shares at 27 dollars per share. The offering was increased from an original plan of 55.6 million shares and helped target a roughly 7.37 to 7.4 billion dollar valuation ahead of the company’s Nasdaq debut. The company deploys enhanced geothermal systems that combine oil and gas drilling techniques, horizontal drilling, fiber optic sensing, and reservoir engineering to deliver around the clock carbon free baseload power, and it had previously raised more than 1.6 billion dollars from investors including Devon Energy, Capricorn Investment Group, DCVC, and Breakthrough Energy Ventures.
Microsoft Exchange, Windows 11 hacked on second day of Pwn2Own

www.bleepingcomputer.com · 2 months ago

During the second day of Pwn2Own Berlin 2026 competitors collected three hundred eighty five thousand seven hundred fifty dollars after exploiting fifteen unique zero day vulnerabilities in products including Windows 11, Microsoft Exchange, and Red Hat Enterprise Linux for Workstations. Cheng Da Tsai, also known as Orange Tsai, earned two hundred thousand dollars by chaining three bugs to achieve remote code execution with SYSTEM privileges on Microsoft Exchange, while other teams demonstrated an integer overflow on Windows 11, a privilege escalation to root on Red Hat Enterprise Linux for Workstations, and a use after free in the NVIDIA Container Toolkit. Researchers also demonstrated exploits against AI coding agents including Cursor and OpenAI Codex, and vendors are given ninety days to patch disclosed zero day flaws.
Popular node-ipc npm package compromised to steal credentials

www.bleepingcomputer.com · 2 months ago

Hackers injected credential stealing malware into newly published versions of node-ipc, a widely used Node.js inter-process communication package on npm. Three malicious releases were confirmed as versions 9.1.6, 9.2.3 and 12.0.1; the compromised CommonJS entry point executes on load, fingerprints hosts, collects environment variables and numerous sensitive files, compresses them, and exfiltrates data via DNS TXT queries. The infostealer extracts cloud provider credentials, SSH keys and configs, Kubernetes Docker Helm and Terraform credentials, npm GitHub and GitLab tokens, dot env files and database credentials, shell histories and CI CD secrets, and macOS keychain and Linux keyring files while skipping files larger than four mebibytes and common directories to reduce noise. Developers should immediately remove the affected versions, rotate any exposed secrets, and inspect lockfiles and npm caches for further compromise.
Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access

thehackernews.com · 2 months ago

Turla, a Russian state sponsored hacking group linked to the FSB, has converted its long running.NET backdoor Kazuar into a modular peer to peer botnet built for stealth and persistent access. The botnet separates functionality into Kernel, Bridge, and Worker modules, with Kernel coordinating tasks, performing anti analysis and sandbox checks, and managing configuration and command and control communication, Bridge acting as a proxy to C2 servers, and Worker logging keystrokes, hooking Windows events, and collecting system and MAPI data. Kazuar modules communicate via Windows Messaging, Mailslot, and named pipes, can reach attacker infrastructure over Exchange Web Services, HTTP, or WebSockets, and elect a Kernel leader to minimize visibility, while droppers such as Pelmeni and ShadowLoader deploy the malware and a dedicated working directory stages, encrypts, and exfiltrates collected data.
[ Removed by Reddit ]

www.reddit.com · 2 months ago

NULL
North Korean Hackers Now Using AI? Kaspersky Warns of New Threat Targeting South Korean Govt Systems

www.ibtimes.sg · 2 months ago

Kaspersky says a North Korea linked hacking group known as Kimsuky has begun integrating large language model technologies into malware development, leaving AI generated comments and emoji like traces in code. Researchers linked a backdoor called HelloDoor and an advanced AppleSeed malware cluster to campaigns targeting South Korean government systems, designed to steal documents, screenshots, keystrokes and authentication credentials. Attackers targeted authentication infrastructure by collecting files from the C GPKI directory that holds digital certificates, exploited Visual Studio Code remote tunneling and GitHub authentication for covert access, and used DWAgent, Cloudflare Quick Tunnels, Ngrok and compromised websites to mask command and control. The group continues to rely on spear phishing with malicious attachments and has shown activity beyond Korea including Brazil and Germany, and researchers warn the combination of AI, stealth techniques and legitimate remote access tools marks an escalation in threat capabilities.
Avada Builder WordPress plugin flaws allow site credential theft

www.bleepingcomputer.com · 2 months ago

There are two vulnerabilities in the Avada Builder WordPress plugin, estimated to have one million active installations, that allow arbitrary file reads and extraction of sensitive database information. One flaw, tracked as CVE-2026-4782, permits authenticated users with subscriber-level access to read any file on the server in plugin versions through 3.15.2 by abusing the shortcode-rendering customsvg parameter and can expose files such as wp-config.php. The other flaw, CVE-2026-4798, is a time-based blind SQL injection exploitable without authentication only when sites previously used and then deactivated WooCommerce, and it can be used to extract password hashes and other sensitive data from sites running versions through 3.15.1. A partial fix was released in version 3.15.2 and a full patch in version 3.15.3 on May 12, 2026, and site owners are advised to update to 3.15.3 as soon as possible.