Blahalla

We built a vulnerability vending machine: AI tokens in, zero-days out

www.bleepingcomputer.com · 6 days ago

Intruder engineered an AI system combining LLMs with code slicing to automatically discover complex vulnerabilities. The team used this methodology to find and exploit a previously unknown multi-stage SQL injection zero-day in a widely used WordPress plugin. This automated process requires no human oversight, demonstrating the full lifecycle of vulnerability discovery through exploitation.

Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws

thehackernews.com · 6 days ago

Mozilla updated Firefox to address two critical vulnerabilities whose exploit code is publicly available. These flaws include an invalid pointer in the JavaScript WebAssembly component, identified as CVE-2026-15718. Furthermore, Mozilla patched a site isolation issue within the DOM Navigation component (CVE-2026-15719).

Russian-Speaking Hacker Uses Gemini CLI to Deploy C2 Botnet in Six Minutes

gbhackers.com · 6 days ago

A Russian-speaking threat actor tracked as “bandcampro” used Google Gemini CLI as an end-to-end operational assistant to migrate a command-and-control server, deploy a replacement VPS, configure Cloudflare tunnels, and restore control of compromised endpoints within six minutes.

New Windows Bind Link techniques let attackers evade EDR, security controls

www.csoonline.com · 6 days ago

Attackers who already have administrator privileges on a Windows machine have newer ways to slip past endpoint security without exploiting a vulnerable driver or modifying trusted binaries.

Windows Bind Link Attacks Can Hide Malware From EDR Tools

www.securityweek.com · 6 days ago

Bitdefender researchers demonstrated how Windows bind links facilitate EDR evasion by creating conflicting filesystem views. These legitimate kernel mechanisms allow attackers to manipulate the link's backing path, loading malware invisibly while appearing to access a trusted file. The techniques include 'file-binding,' which can hijack critical paths like AMSI.dll for defense circumvention.

2-Click Cursor Exploit Enables Dev Environment Takeover

www.darkreading.com · 6 days ago

Researchers discovered an exploit for the Cursor AI coding tool, used by over 50,000 enterprises. Attackers can leverage this vulnerability to install malicious Model Context Protocol (MCP) servers in just two clicks. These fake MCP servers enable arbitrary command execution on privileged developer machines, posing a severe risk of stealing source code or company secrets.

OkoBot Malware Uses ClickFix and SeedHunter to Steal Ledger and Trezor Seed Phrases

gbhackers.com · 6 days ago

OkoBot, a new malware framework, targets cryptocurrency users to steal Ledger and Trezor recovery phrases, credentials, and wallet files. Attackers deploy this multi-stage threat via ClickFix social engineering using fake repositories like MSS Studio. The initial payload, TookPS, installs an SSH service and establishes remote access tunnels while attackers manipulate RDP rules for persistence.

White House launches AI-driven vulnerability clearinghouse to speed cyber remediation

www.csoonline.com · 6 days ago

The White House is expanding the use of AI beyond cyber threat detection into vulnerability management, launching a new program that aims to help government agencies and critical infrastructure operators identify, prioritize, and remediate software vulnerabilities faster.

Microsoft Blocks Windows 11 Security Update on Dell PCs Over Intel Driver Causing Shutdowns and Battery Drain

gbhackers.com · 6 days ago

Microsoft stopped the Windows 11 security update KB5101650 for certain Dell PCs because of an incompatibility between an Intel driver and a new USB-C Connection Manager interface. This conflict impacts systems running versions 24H2 and 25H2, causing unexpected shutdowns, reduced performance, and fast battery draining. Microsoft works with Dell to make a fix before releasing the patch.

3 Russian Nationals Indicted for Running Bulletproof Hosting Network Behind $62 Million Cyberattacks

gbhackers.com · 6 days ago

US indicted 3 Russian nationals & 2 St. Petersburg firms for bulletproof hosting used in ransomware, malware, phishing attacks costing $62M+. Charged with fraud against Volosovik, Zatolokin, & Pankova. Defendants face multiple federal charges.

Apple Tests New iMessage Warning for Malicious Messages

www.techrepublic.com · 6 days ago

Apple is testing a new security alert in iOS 26.6, warning users about potentially malicious iMessages. This feature enables smartphone owners to identify and report suspicious communications directly through the messaging app.

New bugs in Claude for Chrome allow extensions to abuse AI privileges

www.csoonline.com · 6 days ago

Two vulnerabilities found in Anthropic’s Claude for Chrome extension remain exploitable months after they were reported to the company, a research by Manifold Security noted.

US Charges Russian Individuals and Firms for Running Cybercrime Services

www.securityweek.com · 6 days ago

US DOJ indicted Russian nationals (Volosovik, Zatolokin, Pankova) & firms (ML.Cloud, Media Land). They provided hosting for ransomware, phishing, and cybercrime markets targeting 42 entities across 21 US states. Losses reached millions of dollars.

SASE Has An AI Blind Spot. Inspecting Packets Is No Longer Enough.

thehackernews.com · 6 days ago

Traditional cloud proxies struggle with modern workflows, including browser use and generative AI tools. Enterprise work now relies on SaaS apps, browsers, and autonomous agents, creating security blind spots. Security models must adapt because employees frequently paste intellectual property into these diverse digital sources.

LabubaRAT Rust Malware Masquerades as NVIDIA Software to Backdoor Windows Systems

gbhackers.com · 6 days ago

Adversary Pursuit Group (APG) found LabubaRAT, an undocumented Rust-based remote access trojan posing as legitimate NVIDIA software components. The malware uses artifacts such as version metadata and mutex names to establish persistent access on Windows systems. This implant functions as a reusable, panel-managed framework utilizing C2 infrastructure for command control across campaigns.

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

thehackernews.com · 6 days ago

Security researcher Chaotic Eclipse released LegacyHive, a proof-of-concept exploit targeting the Windows User Profile Service (ProfSvc). This vulnerability allows arbitrary hive load and elevates privileges on the system. The service manages user accounts and environments within core Windows components.

A Video Screen That Is Also a Camera

www.schneier.com · 6 days ago

Researchers at ETH Zurich developed a new technology called the Fourier pixel. This hypercharged pixel generates and senses arbitrary light fields by manipulating light’s intensity, oscillation phases, and polarization. The team published these technical findings in the journal Nature.

Vulnerabilities Patched by Fortinet, Ivanti, ServiceNow

www.securityweek.com · 6 days ago

ServiceNow patched RCE (CVE-2026-6875). Ivanti fixed Xtraction path traversal/open redirect (CVE-2026-14902, CVE-2026-14903). Fortinet released 11 advisories for unauthenticated remote attackers. Patches are available now.

Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution

thehackernews.com · 6 days ago

The Cursor IDE on Windows executes any binary file named git.exe found in a project's root directory without prompting users for approval. This flaw allows malicious code to run automatically and continuously as long as the repository remains open. Attackers can exploit this mechanism, potentially accessing sensitive data like source code, SSH keys, or cloud tokens using the user's permissions.

Dell Warns of Critical PowerProtect Data Domain Flaws Allowing Remote Attackers to Take Complete Control

gbhackers.com · 6 days ago

Dell disclosed two critical vulnerabilities in PowerProtect Data Domain appliances: CVE-2026-53483 and CVE-2026-53481. Both flaws score a CVSS v3.1 of 9.8, enabling unauthenticated remote attackers to seize complete control of the systems. Specifically, CVE-2026-53483 involves improper authentication, while CVE-2026-53481 allows path traversal, severely compromising enterprise backup environments.

White House Launches AI-Driven ‘Gold Eagle’ Vulnerability Coordination Initiative

www.securityweek.com · 6 days ago

White House launched Gold Eagle to speed vulnerability patching in critical infrastructure. It pairs open source maintainers with industry via CISA/Treasury per EO 14409. This improves software security.

11 Malicious NuGet Game Cheat Packages Deploy Pepesoft Windows Surveillance Malware

gbhackers.com · 6 days ago

Socket analyzed 11 malicious NuGet packages for game utilities (Albion Online, GTA5RP). They exploit dotnet tool install to run a downloader fetching pepesoft.exe payload. Malware uses DoH DNS and fetches config from Cloudflare/S3. Researchers identified these threats.

TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development

unit42.paloaltonetworks.com · 6 days ago

TuxBot v3 Evolution, an LLM-developed IoT botnet, cross-compiles for ARM, MIPS, RISC-V. It uses a Go C2 server with DDoS services. Attackers brute-force Telnet and use DGA/P2P protocols to maintain control.

When 80,000 fans log on at once: The 2026 World Cup’s unique cybersecurity issues

www.csoonline.com · 6 days ago

With the World Cup in full swing, stadiums across North America are currently accommodating thousands of fans every match day. That said, the stadiums’ biggest security challenge isn’t of a physical nature. It is not hyperbolic to say that football stadiums are some of the most chaotic endpoint environments in enterprise IT.

Progress Confirms Zero-Day Vulnerability Behind ShareFile Disruption

www.securityweek.com · 6 days ago

The company has rolled out a fix and is restoring access for Storage Zones Controller customers who apply it.

CISA warns admins to patch actively exploited SharePoint flaws

www.bleepingcomputer.com · 6 days ago

CISA warns attackers exploit CVE-2026-32201, CVE-2026-45659, & CVE-2026-56164 for RCE/auth bypass on SharePoint. Patching is urged for related CVEs: CVE-2026-55040 and CVE-2026-58644. Implement hardening measures immediately.

HN Security - My Semgrep C/C++ ruleset is ready for prime time again

hnsecurity.it · 6 days ago

The author released an updated Semgrep ruleset designed for C/C++ vulnerability research. Developed since 2022, the tool enhances automated discovery of binary vulnerabilities in complex codebases. These improvements integrate extensive testing results from NIST's Software Assurance Metrics And Tool Evaluation project to guide secure coding workflows.

ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Rockwell

www.securityweek.com · 6 days ago

Siemens, Schneider Electric, & Rockwell patched ICS vulnerabilities. Fixes include a CVSS 10 Opencenter X auth bypass and unauthenticated CLI access via 1715 Redundant IO. Vendors also addressed SCADA arbitrary code execution flaws. CISA/VDE CERT issued further alerts today.

Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware

thehackernews.com · 6 days ago

Security groups OX Security, SafeDep, Socket, and StepSecurity saw four compromised npm packages in the @asyncapi namespace distributing a multi-stage botnet loader. Affected packages are @asyncapi/[email protected], @asyncapi/[email protected], @asyncapi/[email protected], and @asyncapi/specs(v6.11.2). Developers should immediately update these modules to mitigate the botnet risk.

SheetAgent RAT Runs 14 Virtual Machine Checks and Self-Deletes When Analysis Is Detected

gbhackers.com · 6 days ago

Indian job seekers were targeted with a phishing lure for Cabinet Secretariat roles. Attackers used a ZIP archive deploying SheetAgent RAT via malicious shortcuts and PowerShell scripts to install ControlR RMM and a.NET dropper. This extracted payload disguised itself in WindowsDefenderSyncService.exe.

From Twitter to X: 20 Years of Memes, Movements and Hot Takes

www.nytimes.com · 6 days ago

The platform initially appeared on July 15, 2006, after an earlier soft launch. Following its acquisition by Elon Musk, the company rebranded the service as X.

Cybersecurity needs more prevention and less reliance on cure

www.csoonline.com · 6 days ago

Ask any medical doctor, and they’ll tell you that prevention is better than cure. It’s more cost-effective and it has better outcomes. The same is true in cybersecurity. But we believe that our industry has veered too far away from this simple concept.

The Memory Heist - How I tricked Claude into leaking your deepest, darkest secrets

www.ayush.digital · 6 days ago

Study shows AI's memory + browsing risks; "memory heist" simulates data theft from assistants like Claude. Attackers could steal private info (names, security answers). Unauthorized access is possible.

Microsoft: Some Dell PCs shut down after recent Windows updates

www.bleepingcomputer.com · 6 days ago

Microsoft blocked KB5101650 for Dell PCs (Win 11 25H2/24H2) due to conflict between the USB-C Connection Manager and Intel Innovation Platform Framework Processor Participant driver, causing shutdowns. A fix is pending.

(More) Unauthenticated Arbitrary Code Execution in ServiceNow

palk.sh · 6 days ago

Unauthenticated RCE affects default ServiceNow components. Attackers use JS payloads via fields like the forgot password page for sandbox escape, running jobs as System to steal all third-party credentials. Patches started Feb 2025.

Nigeria Deepens Cybersecurity Efforts as Cybercriminals See More Profits

www.darkreading.com · 6 days ago

The West African country advanced rules to force organizations to disclose cyberattacks, joining other nations in a shift to mandated transparency.

US charges alleged operators of Russian bulletproof hosting service

www.bleepingcomputer.com · 6 days ago

U.S. federal prosecutors have unsealed charges against three Russian nationals, accusing them of providing bulletproof hosting (BPH) services to ransomware gangs that caused over $62 million in damages to victims worldwide.

Critical Vulnerabilities Patched With Fresh Chrome 150, Firefox 152 Updates

www.securityweek.com · 6 days ago

Mozilla issued Firefox 152 updates resolving two critical defects via CVE-2026-15718 and CVE-2026-15719. Separately, Google released Chrome 150, patching fifteen vulnerabilities including use-after-free flaws tracked as CVE-2026-15764 and CVE-2026-15765. Both browser vendors confirmed that though exploit code exists for these bugs, they observed no in-the-wild attacks.

FaceTime Scammers Combine Credential Theft, Remote-Access Apps, and iOS Exploits for Device Takeover.

gbhackers.com · 6 days ago

Apple-focused scam operations are increasingly using FaceTime as a high-trust social-engineering channel to steal credentials and, in higher-risk cases, prepare victims for device compromise. Apple said threat actors may approach targets via phone calls, FaceTime, SMS, email, and other communications, posing as a legitimate organization.

Microsoft Fixes Multiple Windows RDP Flaws Exposing Sensitive Data Over the Network

gbhackers.com · 6 days ago

Microsoft patched five information-disclosure vulnerabilities in the Windows Remote Desktop Protocol (RDP). The critical flaws include CVE-2026-50445, CVE-2026-50497, CVE-2026-55003, CVE-2026-57979, and CVE-2026-57982. Exploitation could allow attackers to retrieve sensitive data from vulnerable hosts' application memory over the network.

7 skills and traits of elite security engineers

www.csoonline.com · 6 days ago

Security engineers play a pivotal role in enterprise cybersecurity, because they are the professionals who design, build, and deploy security systems to protect an organization’s data, applications, systems, networks, and other IT components against a variety of cyber threats.

Critical SonicWall SMA 1000 SSRF and Remote Code Execution Flaws Actively Exploited in the Wild

gbhackers.com · 6 days ago

SonicWall confirmed flaws in SMA1000 appliances. The highest risk is CVE-2026-15409, an unauthenticated Server-Side Request Forgery flaw with a CVSS score of 10.0. Separately, CVE-2026-15410 permits authenticated code injection via the Management Console (CVSS 7.2), requiring immediate patching through platform hotfixes.

Hackers Abuse OAuth Device Codes and Entra ID Enrollment for Persistent SaaS Access

gbhackers.com · 6 days ago

AI phishing abuses OAuth/Entra ID for SaaS access. Toolkits like Jalisco generate real-time codes, capturing tokens post-MFA. Thieves use this token theft with rogue device registration to gain persistent refresh tokens.

Google Chrome 150 Update Fixes 15 Security Vulnerabilities, Including 2 Critical Use-After-Free Flaws

gbhackers.com · 6 days ago

Chrome 150 patches Ozone, Skia, V8 for multiple flaws: Use-after-free (CVE-2026-15764, CVE-2026-15765), type confusion (CVE-2026-15776), and overflow. It also fixes CVE-2026-15773 and CVE-2026-15775. The update addresses numerous CVEs through researcher contributions.

Critical Claude for Chrome Flaw Lets Malicious Extensions Read Gmail, Google Docs, and Calendar

gbhackers.com · 6 days ago

Claude for Chrome has a vulnerability (CVSS 9.6) allowing misuse of AI by malicious extensions. Lack of isTrusted check permits programmatic event injection, letting attackers bypass approvals to access data in Gmail, Google Docs, or Calendar.

China-Linked Hackers Weaponize Claude Code and DeepSeek in Government Intrusion Campaign

gbhackers.com · 6 days ago

Suspected China group used Claude Code and DeepSeek-v4-pro in attacks against Taiwanese governments/finance. TencShell malware was found on servers, exposing tools, code, and kits. Attackers used LLMs for command execution and phishing page development.

Fortinet Patches 7 Security Flaws Affecting FortiOS, FortiProxy, FortiPAM, FortiSASE, and FortiSandbox

gbhackers.com · 6 days ago

Fortinet issued security updates addressing seven vulnerabilities across products like FortiOS and FortiSandbox. The most severe flaw, CVE-2026-59835, exposes VNC access via unauthenticated means in FortiSandbox. Patches also resolve critical issues including path traversal (CVE-2026-59839) and multiple header injections, alongside other flaws such as CVE-2025-43892 and CVE-2026-59837.

Notepad++ v8.9.7 Security Update Fixes 5 Vulnerabilities, Including Stack Buffer Overflow and Zip Slip Flaws

gbhackers.com · 6 days ago

Notepad++ 8.9.7 patched five flaws: Zip Slip (CVE-2026-57233), stack overflow (CVE-2026-54758), startswith bypass (CVE-2026-52886), and macro HMAC issues across session/file processing. The update addresses multiple vulnerabilities for users.

Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands

thehackernews.com · 6 days ago

SonicWall warned of active exploitation targeting two zero-day vulnerabilities in Secure Mobile Access (SMA) 1000 series appliances. One flaw is CVE-2026-15409, a Server-side request forgery vulnerability. Remote unauthenticated attackers could exploit this weakness to achieve arbitrary command execution on the systems.

Artlist ClickFix Campaign Uses Infostealer-Stolen WordPress Credentials to Deploy RAT Malware

gbhackers.com · 6 days ago

Artlist subdomain was abused mid-July 2026 to distribute RAT via fake CAPTCHA prompts. Attackers first stole credentials from an Israeli developer using pirated Adobe Acrobat Pro DC infection, deploying ClickFix social engineering and EtherHiding C2 infrastructure.