Blahalla

Critical WordPress Plugin Flaw Allows Unauthorized Access to Websites

gbhackers.com · 2 months ago

A critical authentication bypass in the Burst Statistics WordPress plugin, tracked as CVE-2026-8181 with a CVSS score of 9.8, affects versions 3.4.0 through 3.4.1.1 and exposed more than 200,000 websites to potential takeover. The flaw, introduced on April 23, 2026, stems from improper validation of application password authentication in the plugin’s MainWP integration that treats non-error or null responses as valid, allowing an attacker who knows a valid administrator username to craft malicious HTTP requests that impersonate an administrator for the duration of the request. Exploitation can create a new administrator account via WordPress REST API endpoints without valid credentials; Wordfence deployed firewall rules for premium users on May 8, 2026 and the plugin developer released version 3.4.2 on May 12, 2026 to fix the issue, so site owners are urged to update to 3.4.2 or later immediately.
Sandworm Hackers Shift From IT Breaches to Critical OT Targets

gbhackers.com · 2 months ago

There is a new wave of cyber activity linked to Sandworm that is pivoting from IT network breaches into operational technology environments, targeting engineering workstations, human machine interfaces, programmable logic controllers and remote terminal units. There were 29 confirmed Sandworm-related incidents across 10 industrial organizations in seven countries between July 2025 and January 2026, with telemetry showing attackers commonly enter via compromised IT systems and then move laterally into OT. Attackers rely on living off the land techniques and preexisting tools such as Cobalt Strike and Metasploit and continue to exploit legacy exploit chains like EternalBlue, DoublePulsar and WannaCry rather than using new zero days, with affected systems showing an average 43 day warning window before escalation. This pattern indicates many incidents could have been prevented through basic cyber hygiene including timely patching, investigating routine alerts and restricting lateral movement as Sandworm escalates activity instead of retreating.
AI Drives Cybersecurity Investments, Widening 'Valley of Death'

www.darkreading.com · 2 months ago

Investment dollars in AI security startups exceeded the value of AI acquisitions in the first quarter of 2026 by more than one billion dollars, with financing reaching three point eight billion dollars while mergers and acquisitions totaled two point six billion dollars across 108 deals. Experts say the influx of capital is concentrating venture dollars into fewer companies, widening the so called valley of death for many non AI native and mid market cybersecurity startups and making differentiation and scaling difficult. Analysts predict a wave of consolidation with larger multibillion dollar acquisitions likely within the next twelve to eighteen months as buyers seek to rationalize overlapping offerings and secure AI related capabilities.
FlowerStorm phishing gang adopts virtual-machine obfuscation to evade email defenses

www.csoonline.com · 2 months ago

Researchers identified a widely active phishing as a service operation called FlowerStorm that has begun using a browser based virtual machine named KrakVM to compile and execute encrypted JavaScript bytecode inside HTML attachments, adding layered obfuscation that complicates static analysis and email security detection. Victims receive HTML attachments disguised as voicemail notices invoices or vendor communications that load credential harvesting pages which target credentials and multi factor authentication codes for services such as Microsoft 365 Hotmail and GoDaddy while supporting adversary in the middle interception to hijack authenticated sessions. The phishing kit dynamically adapts by preloading victim email addresses enumerating registered MFA methods including push TOTP SMS and voice flows and forwarding captured credentials to command and control servers that perform real logins and session relays. Researchers published indicators of compromise across global cloud storage regions and warned that the apparent use of default configurations means VM based obfuscation could spread rapidly across phishing ecosystems creating a growing detection gap for defenders.
Mythos Proves Potent in Vulnerability Discovery, Less Convincing Elsewhere

www.securityweek.com · 2 months ago

Independent benchmarking shows Anthropic's Mythos significantly improves vulnerability discovery, with particular strength in source code audits and when testing live applications together with source. Tests found it strong in native code analysis, reverse engineering, and practical browser interactions, but its exploit validation and higher order judgment are inconsistent, often requiring precise prompts and occasionally missing true positives. Mythos is also reportedly about five times more expensive than the Opus model, and when performance is normalized by cost it is not always best in class, with some competitors outperforming it on certain web vulnerability tasks.
Windows DNS Client Security Flaw Exposes Systems to Remote Code Execution

gbhackers.com · 2 months ago

There is a critical vulnerability in the Windows DNS Client that can allow remote code execution without any user interaction. Tracked as CVE-2026-41096 and rated CVSS 9.8, the bug is a heap-based buffer overflow in dnsapi.dll categorized under CWE-122. Microsoft released a patch in its May 12, 2026 security updates and administrators are advised to deploy those updates, reboot systems, restrict DNS to trusted resolvers, and monitor for unusual DNS activity. Microsoft currently classifies exploitation as unlikely and there are no public exploits or evidence of in-the-wild attacks at the time of reporting.
Akamai to Acquire AI and Browser Security Firm LayerX for $205 Million

www.securityweek.com · 2 months ago

Akamai will acquire LayerX, a firm focused on AI and browser security, for roughly 205 million dollars. LayerX offers a platform that delivers real time visibility and control over user and agent activities across browsers, applications, and integrated development environments, with capabilities for shadow AI discovery, generative AI data loss prevention, access controls for AI tools, misuse detection, and protection for AI browsers and plugins while also addressing extension management, safe browsing, and secure access. The deal, expected to close in the third quarter of 2026, will integrate LayerX into Akamai's Zero Trust organization and LayerX is projected to reach about 10 million dollars in annual recurring revenue by year end. LayerX recently disclosed several vulnerabilities including one that could allow AI agents to be taken over and incidents involving data stealing browser extensions, and Akamai expects the acquisition to dilute its non GAAP earnings per share by approximately 0.12 dollars in fiscal 2026.
CVE-2026-44338: Scanners Target PraisonAI Within Four Hours of Disclosure

deafnews.it · 2 months ago

There is an authentication bypass tracked as CVE-2026-44338 in the PraisonAI legacy Flask API that set authentication disabled by default and left the endpoints accessible in versions 2.5.6 through 4.6.33, yielding a CVSS v3.1 score of 7.3 and allowing unauthenticated access to agent lists and triggering workflows that can exhaust LLM quotas, exfiltrate data, or activate local tools. An automated scanner identifying itself as CVE-Detector slash 1.0 probed exposed instances less than four hours after the advisory published on May 11, 2026, with the first confirmation at 17 40 55 UTC from IP address 146.190.133.49 in the DigitalOcean network, and observed activity appears to be reconnaissance rather than active POST exploitation so far. Immediate mitigations are to update to version 4.6.34, remove or restrict internet exposure of the legacy API, inspect logs for the CVE-Detector user agent and the reported IP, and audit agents.yaml to reduce agent permissions.
How to Check Computer Activity: 2026 Guide for Windows and Mac

www.currentware.com · 2 months ago

There are built in utilities for Windows and Mac to check recent computer activity, such as using Windows Event Viewer and filtering Power Troubleshooter events to see when a PC was powered on and using the last command or the Console app on Mac to view login and wake events. There are simple file and browser checks such as opening the recent folder or using standard browser history, but private browsing modes leave no trace unless a dedicated monitoring tool is used. There are enterprise monitoring solutions that capture web activity even in private modes, log application usage and bandwidth, track USB device connections and transfers with alerts, and provide a central console for managing multiple devices. There are common uses for activity monitoring including productivity tracking, software asset optimization, cybersecurity, and forensic investigations, and recent product updates emphasize single sign on, redundant databases, trend based reporting, and AI driven productivity grading.
Chinese APT Exploits Microsoft Exchange to Breach Energy Sector Network

gbhackers.com · 2 months ago

Chinese state aligned hackers exploited an unpatched Microsoft Exchange server at a major energy firm in Azerbaijan beginning December 25, 2025, using the ProxyNotShell exploit chain to install multiple web shells and maintain persistent access. The campaign, attributed with moderate to high confidence to the FamousSparrow cluster, ran for months and deployed Deed RAT via a LogMeIn Hamachi DLL sideloading chain, then attempted to deploy the Terndoor backdoor using a Mofu loader and a signed binary renamed deskbandinjector64.exe that dropped a kernel mode driver named vmflt.sys. Attackers moved laterally using Remote Desktop Protocol and Impacket style atexec and smbexec techniques to spread implants across servers, repeatedly returning to the same Exchange entry point after partial cleanup. Defenders are urged to patch or isolate exposed Exchange servers, monitor for IIS worker processes writing ASPX files, detect DLL sideloading and suspicious kernel drivers, rotate high privilege credentials, and conduct thorough memory and network forensics to evict the intruders.
KongTuke hackers now use Microsoft Teams for corporate breaches

www.bleepingcomputer.com · 2 months ago

KongTuke initial access brokers now use Microsoft Teams to socially engineer employees, moving from cold outreach to a persistent foothold in under five minutes by impersonating IT support and using Unicode whitespace tricks to appear legitimate. Victims are persuaded to paste a malicious PowerShell command that downloads a Dropbox ZIP with a portable WinPython environment which launches ModeloRAT, a Python-based implant that collects system and user information, captures screenshots, and can exfiltrate files. The campaign has been active since at least April 2026 with the actor rotating through multiple Microsoft 365 tenants, and ModeloRAT has evolved to use a resilient five-server C2 pool with failover and randomized paths, multiple independent access paths including a reverse shell and TCP backdoor, and expanded persistence via Run keys, startup shortcuts, VBScript launchers, and SYSTEM scheduled tasks that can survive standard cleanup. Recommended defenses include restricting external Teams federation with allowlists and hunting for the indicators of compromise and persistence artifacts provided by the researchers.
Chinese APTs Expand Targets, Update Backdoors in Recent Campaigns

www.securityweek.com · 2 months ago

Salt Typhoon conducted sustained intrusions between December 2025 and February 2026 against an Azerbaijani oil and gas company and broader government, telecom, and technology targets, exploiting Microsoft Exchange vulnerabilities, deploying web shells, using DLL sideloading to install the Deed RAT, and later introducing the TernDoor backdoor. The attackers used the ProxyNotShell exploit chain, disguised backdoors in folders and services mimicking LogMeIn Hamachi, abused RDP and Impacket tools for lateral movement, and repeatedly attempted to regain access after remediation. Twill Typhoon targeted Asia Pacific and Japanese organizations from September 2025 through April 2026 with an updated modular.NET RAT framework named FDMTP, using ClickOnce and DLL sideloading while fetching legitimate binaries and matching config files from domains impersonating well known content delivery services.
Foxconn Attack Highlights Manufacturing's Cyber Crisis

www.darkreading.com · 2 months ago

A Nitrogen ransomware attack hit several of Foxconn's North American facilities, with the company confirming a malicious actor disrupted operations and the threat group claiming to have exfiltrated more than 11 million files totaling about eight terabytes including confidential engineering schematics, project documentation, and records tied to major technology clients. Manufacturers are being increasingly targeted because they have low tolerance for downtime and central roles in supply chains, with industry data showing as many as six hundred ransomware incidents against manufacturers so far this year and median ransom payments around four hundred thousand dollars. Security firms say Nitrogen uses tactics such as SEO poisoning and fake software installers to gain access, and the continued listing on the group's leak site suggests negotiations or extortion efforts may still be ongoing.
New Malware Framework Enables Screen Control and UAC Bypass

gbhackers.com · 2 months ago

A sophisticated malware framework named TencShell uses a multi stage attack that delivers in memory payloads disguised as web font files and executes Donut shellcode to load the implant without touching disk. TencShell enables remote command execution, file and process access, system profiling, screen capture with simulated mouse and keyboard interaction, extraction and cleanup of Chrome and Edge artifacts, SOCKS5 proxying, in memory deployment of additional payloads, and a User Account Control bypass. Persistence is achieved via a Windows Registry Run key named OneDriveHealthTask while command and control traffic is designed to mimic Tencent style API requests to blend into legitimate backend communications. Investigators correlated suspicious infrastructure and host artifacts to identify a full intrusion attempt that was blocked before a stable foothold was established, underscoring the trend of attackers repurposing open source C2 frameworks into stealthy post exploitation toolkits.
Critical Exim Mailer Flaw Enables Remote Code Execution Attacks

gbhackers.com · 2 months ago

A newly disclosed critical vulnerability nicknamed Dead.Letter and tracked as CVE-2026-45185 allows unauthenticated remote code execution against Exim mail servers when Exim versions 4.97 through 4.99.2 are built with GnuTLS and the server advertises both STARTTLS and CHUNKING. The bug is a use after free in BDAT chunked message parsing where a TLS closenotify during a BDAT body can cause a one byte write that corrupts Exim’s custom pool allocator, enabling heap manipulation and full server compromise. Exploitation is practical and unauthenticated, with researchers demonstrating both human-crafted and large language model assisted exploit chains, so administrators should urgently upgrade to Exim 4.99.3 or later or mitigate by rebuilding with OpenSSL, disabling BDAT chunking, or restricting STARTTLS exposure until patched.
PraisonAI CVE-2026-44338 Auth Bypass Targeted Within Hours of Disclosure

thehackernews.com · 2 months ago

Threat actors attempted to exploit PraisonAI within hours of public disclosure of CVE-2026-44338, a missing authentication flaw rated CVSS 7.3. The legacy Flask API server ships with authentication disabled by default, allowing unauthenticated callers to enumerate the configured agent file via the agents endpoint, trigger the agents.yaml workflow via the chat endpoint, consume model or API quota, and receive results from PraisonAI.run. Security telemetry showed a scanner identifying as CVE-Detector 1.0 probing exposed instances roughly three hours and forty four minutes after the advisory was published, and operators are advised to update to version 4.6.34, audit deployments, review model billing for anomalous usage, and rotate credentials referenced in agents.yaml.
PraisonAI vulnerability gets scanned within 4 hours of disclosure

www.csoonline.com · 2 months ago

A newly disclosed authentication bypass flaw in the open source AI orchestration framework PraisonAI was probed by internet scanners less than four hours after a GitHub advisory was published on May 11, 2026. The legacy Flask based API server shipped with authentication disabled by default in versions 2.5.6 through 4.6.33, allowing unauthenticated callers to interact with agent workflows, and the behavior was removed in PraisonAI 4.6.34. The flaw is tracked as CVE-2026-44338 with a CVSS score of 7.3, and reconnaissance from a scanner identifying as CVE Detector 1.0 quickly targeted common and PraisonAI specific paths including version.txt, docs, and API agents endpoints. Organizations are urged to upgrade immediately to PraisonAI 4.6.34 or later, discontinue use of the legacy api server entrypoint, and monitor for the scanner user agent and suspicious requests to agent and chat related endpoints.
How AI Hallucinations Are Creating Real Security Risks

thehackernews.com · 2 months ago

AI hallucinations are introducing serious security risks into critical infrastructure decision-making by producing highly confident yet incorrect outputs that exploit human trust. A 2025 benchmark of 40 AI models found that all but four were more likely to give a confident incorrect answer than a correct one on difficult questions, raising concerns as AI is increasingly used in cybersecurity operations. There are three main ways these hallucinations impact security: missed threats where novel attacks go undetected, fabricated threats that generate false positives and alert fatigue, and incorrect remediation that can trigger harmful changes such as deleting files or altering configurations. To reduce risk organizations should require human review before privileged actions, treat training data as a security asset, enforce least privilege for AI systems, train staff in precise prompt engineering, and center identity security in AI governance.
Canon MailSuite Security Flaw Allows Attackers to Execute Code Remotely

gbhackers.com · 2 months ago

Canon disclosed a critical vulnerability in GUARDIANWALL MailSuite that can allow remote arbitrary code execution through a stack based buffer overflow in the pop3wallpasswd command, officially announced on May 13, 2026. Affected versions are 1.4.00 through 2.4.26, while older 7.x and 8.x releases and versions before 1.4.00 are not impacted. Canon released patches directly to customers and recommends applying them, and for organizations unable to patch immediately administrators can stop the MailSuite administration service using the grdn wgw work init script to reduce exposure. The flaw is cataloged in the Japan Vulnerability Notes under identifier 35567473 and security teams are advised to audit deployments and monitor for unusual web service requests to MailSuite systems.
G7 Countries Release AI SBOM Guidance

www.securityweek.com · 2 months ago

Agencies in the United States, Canada, Japan, Germany, France, Italy, the United Kingdom, and the European Union published joint guidance named Software Bill of Materials for AI Minimum Elements to help public and private organizations enhance transparency across AI systems and supply chains. The guidance defines seven minimum SBOM clusters for AI metadata, models, key performance indicators, infrastructure, security properties, system level properties, and dataset properties, and gives example elements such as author and version metadata, model identifiers and hashes, dataset provenance, infrastructure components, security controls, and vulnerability referencing. The recommendations are voluntary and nonbinding, are offered as actionable baseline elements, and caution that retrospective documentation is limited while encouraging continuous automated SBOM generation to address challenges from AI assisted development and opaque dependencies.
How Dangerous Is Anthropic’s Mythos AI?

www.schneier.com · 2 months ago

Anthropic announced Claude Mythos Preview and restricted its release to select partners after claiming it excels at finding software vulnerabilities, and independent testing found OpenAI's GPT-5.5 and smaller models can deliver comparable results. Security teams have used these models to find and fix many flaws, with Mozilla reporting that Mythos helped uncover 271 vulnerabilities in Firefox, but attackers can use the same capabilities to automate discovery and exploitation across critical systems. The near term will likely see a surge in automated attacks alongside more frequent patching, while long term improvements in AI may help defenders yet also enable discovery of hard to fix loopholes in complex regulatory systems.
170 npm Packages Hijacked to Steal GitHub, AWS & Kubernetes Secrets

gbhackers.com · 2 months ago

A large scale supply chain attack has compromised more than 170 npm packages and two PyPI libraries, collectively downloaded over 200 million times per week, to steal developer and cloud credentials. The malicious npm packages include a hidden preinstall script that deploys a loader, downloads a runtime, and runs a heavily obfuscated JavaScript payload that exfiltrates GitHub tokens, OIDC identity data, npm publishing credentials, AWS credentials, Kubernetes service account tokens, Vault tokens, SSH keys, and other secrets. The campaign began by exploiting a misconfigured GitHub Actions release workflow that allowed untrusted forked code to run, enabling attackers to publish compromised packages with legitimate credentials, modify packages to propagate further, and include a dead man switch that can trigger destructive actions if tokens are revoked. Researchers linked the activity to the resurfacing Shai Hulud malware, observed strong obfuscation and encrypted exfiltration channels, and reported that detections blocked the malicious packages within 24 hours while recommending stricter CI CD controls, runtime monitoring, and credential hygiene.
F5 Patches Over 50 Vulnerabilities

www.securityweek.com · 2 months ago

F5 released fixes for over 19 high-severity and 32 medium-severity vulnerabilities affecting BIG-IP, BIG-IQ, and NGINX. The most severe is CVE-2026-42945, a denial of service in NGINX ngxhttprewritemodule with a CVSS v4.0 score of 9.2 that can trigger a heap buffer overflow and restart and may allow code execution if address space layout randomization is disabled, and CVE-2026-41225 is an iControl REST weakness with a CVSS v4.0 score of 8.6 that could let an authenticated Manager create configuration objects leading to command execution and privilege escalation. F5 also patched authentication required remote code execution and remote command injection issues in BIG-IP including CVE-2026-41957, CVE-2026-34176, and CVE-2026-39459, and none of the vulnerabilities appear to have been exploited in the wild.
Microsoft Research: AI Can Generate Realistic Command-Line and Process Telemetry

gbhackers.com · 2 months ago

Researchers propose using artificial intelligence to convert adversary tactics techniques and procedures into synthetic command line and process telemetry that reproduces command line arguments process names and parent child relationships so detection systems can be trained and tested. Three methods were evaluated, prompt engineered generation, agentic workflows, and reinforcement learning with verifiable rewards, with agentic workflows producing the most consistent improvements in recall and fidelity, particularly when paired with reasoning capable models. Synthetic telemetry can simulate rare or emerging threats, avoid exposing sensitive data, speed detection development, enable reproducible experiments, and could allow defenders including Microsoft Defender customers to test defenses more broadly and at scale.
CVE-2026-42945 : NGINX Heap Buffer Overflow in rewrite module - Writeup and PoC

depthfirst.com · 2 months ago

There are four remote memory corruption vulnerabilities discovered in NGINX, including a critical heap buffer overflow introduced in 2008 that affects versions 0.6.27 through 1.30.0 and can lead to remote code execution when rewrite and set directives are used. The issues are tracked as CVE-2026-42945 critical CVSS 9.2 heap overflow in the ngxhttprewritemodule, CVE-2026-42946 high CVSS 8.3 excessive allocation in the ngxhttpscgi and ngxhttpuwsgi modules, CVE-2026-40701 medium CVSS 6.3 use after free in the ngxhttpsslmodule, and CVE-2026-42934 medium CVSS 6.3 out-of-bounds read in the ngxhttpcharsetmodule. Exploitation of CVE-2026-42945 results from a two pass script engine length calculation mismatch where an isargs flag is set during the first pass but not present in the zeroed sub engine used for length calculation, causing escaped URI expansion during the copy pass to overflow the heap and enabling controlled overwrites that can be escalated to RCE if ASLR is bypassed. A proof of concept demonstrates RCE with ASLR disabled and the issues were reported to NGINX with fixes provided.
Dell confirms its SupportAssist software causes Windows BSOD crashes

www.bleepingcomputer.com · 2 months ago

Dell confirmed that its SupportAssist Remediation service update is causing blue-screen crashes and random reboots on some Windows 10 and Windows 11 systems, triggering 0xEFDellSupportAssBUGCHECKCRITICALPROCESS errors. Dell identified version 5.5.16.0 of the Dell SupportAssist Remediation service and the Alienware SupportAssist Remediation service as the trigger and advised users to disable the service or uninstall the SupportAssist app as a workaround. Dell warned that uninstalling the faulty service can remove system repair points created by Dell OS SupportAssist Recovery and urged affected customers to contact support while engineering works on a fix.
Amazon Quick Security Flaw Allowed Restricted Users to Access AI Chat Agents

gbhackers.com · 2 months ago

A security flaw in Amazon Quick allowed restricted users to bypass administrative restrictions and interact with AI chat agents because server side authorization checks were missing in the Chat Agent API. Custom permission settings were enforced only in the user interface so direct HTTP requests to backend endpoints returned valid AI responses even when chat capabilities were supposed to be disabled, enabling same account users to bypass governance and compliance controls. Fog Security reported the issue on March 4, 2026 and AWS rolled out fixes starting March 11 with a global deployment by March 12, after which unauthorized API requests began returning 401 Unauthorized. AWS classified the issue as none in severity and issued no public advisory, highlighting fragmented access control in Quick and the need for consistent server side enforcement across UI and APIs.
Hackers Targeted PraisonAI Vulnerability Hours After Disclosure

www.securityweek.com · 2 months ago

An authentication bypass tracked as CVE-2026-44338 affected PraisonAI deployments from version 2.5.6 through 4.6.33 because a legacy Flask API server shipped with authentication disabled by default, allowing callers to access the agents endpoint and trigger the configured agents.yaml workflow through the chat endpoint without a token. Security telemetry shows a scanner identifying as CVE-Detector 1.0 began probing internet exposed instances less than four hours after disclosure, performing rapid reconnaissance that enumerated agents but did not invoke workflows, suggesting automated validation rather than interactive exploitation. Remote code execution depends on what the exposed workflows are allowed to do, the flaw was fixed in PraisonAI version 4.6.34, and organizations are urged to update immediately.
Lyrie.ai Unveils Open Standard for Agent Security and Joins Anthropic’s Cyber Verification Program

gbhackers.com · 2 months ago

There is an open cryptographic standard called the Agent Trust Protocol that provides a verifiable framework for five security primitives: identity, scope, attestation, delegation, and revocation. OTT Cybersecurity, the developer of Lyrie.ai, announced ATP, published a reference implementation under the MIT license, and joined Anthropic’s Cyber Verification Program to conduct responsible vulnerability research and red-teaming on Claude’s infrastructure. The Lyrie Security Suite complements ATP with an autonomous seven-stage penetration workflow, GPU-powered adversarial red-teaming using H200 infrastructure, and a high-speed binary analysis Omega-Suite aligned to the 2026 Agentic Security Initiative taxonomy.
When ransomware gets physical: cybercriminals turn to threats of violence

www.bitdefender.com · 2 months ago

There is a growing trend of ransomware groups using real world threats, including explicit threats to harm victims, their families, or staff, and hiring local people to carry out intimidation. A study by identity security firm Semperis found that forty percent of ransomware attacks included threats of physical violence, rising to forty six percent in the United States. Law enforcement has warned about loosely affiliated networks such as The Com that have used tactics including throwing bricks through windows, arson, kidnapping, and shootings, and reports include cases where victims were kidnapped and severely harmed. Security guidance urges organizations to treat employee personal information as highly sensitive and to update incident response plans to handle extortion and threats as well as data recovery.
Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation

thehackernews.com · 2 months ago

There are two new Windows zero-days codenamed YellowKey and GreenPlasma that enable a BitLocker bypass via the Windows Recovery Environment and a privilege escalation in the Windows Collaborative Translation Framework CTFMON, respectively. YellowKey affects Windows 11 and Windows Server 2022 and 2025 and works by placing specially crafted FsTx files on a USB drive or EFI partition, rebooting into WinRE, and triggering a shell that can run with BitLocker unlocked even if TPM plus PIN is enabled. GreenPlasma allows an unprivileged user to create arbitrary memory section objects in directory objects writable by SYSTEM potentially enabling manipulation of privileged services and escalation to a SYSTEM shell, though the released proof of concept is incomplete. Related findings include that BlueHammer was assigned CVE-2026-33825 and patched, and that a boot manager downgrade attack exploiting CVE-2025-48804 can be used with physical access to bypass BitLocker on vulnerable systems.
GitLab Security Flaw Allows Cross-Site Scripting and Unauthenticated DoS

gbhackers.com · 2 months ago

GitLab released urgent patches on May 13, 2026 for self managed Community and Enterprise editions, versions 18.11.3, 18.10.6, and 18.9.7 to fix 25 vulnerabilities, with a focus on four high severity cross site scripting bugs and three unauthenticated denial of service flaws. The XSS bugs carry CVSS scores of 8.7 and result from improper input sanitization in features including analytics dashboards, global search, and Duo Agent output, allowing authenticated attackers to execute arbitrary JavaScript and hijack sessions or steal tokens. The unauthenticated DoS issues carry CVSS 7.5 and can be triggered by specially crafted requests or malformed JSON payloads sent to the CI CD job update API, Duo Workflows API, or internal API endpoints, potentially crashing servers and disrupting continuous integration pipelines. Reported CVE identifiers include CVE 2026 7481, CVE 2026 5297, CVE 2026 6073, CVE 2026 7377, CVE 2026 1659, CVE 2025 14870, CVE 2025 14869, CVE 2026 1322, CVE 2026 1184, and several other medium and low severity CVEs, and administrators of self managed instances are advised to upgrade immediately while GitLab com users are already protected.
Hackers Hijack HWMonitor to Sideload Malicious DLL

gbhackers.com · 2 months ago

Hackers hijacked the CPUID HWMonitor distribution by packaging the genuine executable with a malicious DLL named CRYPTBASE.dll inside a fake installer ZIP so the legitimate binary sideloads attacker code. The malicious DLL spawns separate threads to initiate the attack and to load the real system cryptbase DLL while a multi stage reflective loading chain decrypts and executes payloads in memory, culminating in the STX RAT without writing intermediate files to disk. STX RAT uses API hashing, PEB based anti debugging, XOR string obfuscation, extensive reconnaissance of host and security products, hidden desktop creation and BitBlt screen capture, and communicates with command and control using structured JSON. Defenses include validating download sources, employing behavioral detection and SIEM rules to flag DLL sideloading, memory regions with RWX permissions, reflective loaders, hidden desktop interactions, screen capture activity and unusual outbound connections.
Ishmael Reed Is Writing a Play About Elon Musk

www.nytimes.com · 2 months ago

Ishmael Reed, the provocateur and playwright, has written a new play that skewers Silicon Valley billionaires and centers its satire on Elon Musk. The production frames tech titans as powerful cultural figures whose ambitions and influence invite sharp criticism and public debate.
What CISOs need to land a board role

www.csoonline.com · 2 months ago

There are complex relationships between CISOs and corporate boards, with many boards lacking cyber expertise and security leaders sometimes viewed as too technical to win the support they need. Some CISOs pursue board and vendor advisory roles to improve communication with directors, shape product roadmaps, influence risk appetite and investment priorities, and help prevent crises before they occur. Securing a board role often requires persistence and significant time commitment, plus governance capability and credibility gained through committee work, not for profit boards, formal governance education, and relevant certifications. Serving on boards provides a director mindset, a stronger ability to translate cyber risk into strategic and financial terms, broader sector perspective, and expanded networks that enhance resilience and decision making.
Crypto Industry Pushes a Bill to Tilt Regulation in Its Favor

www.nytimes.com · 2 months ago

Crypto firms are lobbying Congress to approve a sweeping federal framework they helped shape after a series of political victories under President Trump. The Senate Banking Committee released a 309 page draft of the Digital Asset Market Clarity Act ahead of a May 14, 2026 markup that would define digital commodities and allocate regulatory responsibilities. Key compromises focus on restricting stablecoin yield that is economically equivalent to bank interest, even as more than a hundred amendments from banks and other stakeholders set up ongoing battles over ethics and conflict of interest provisions.
US charges suspected Dream Market admin arrested in Germany

www.bleepingcomputer.com · 2 months ago

The alleged main administrator of Dream Market Incognito Market, Owe Martin Andresen age 49, has been indicted in the United States on multiple money laundering charges after being arrested in Germany. A federal grand jury charged him with six counts of international concealment money laundering and six counts of concealment money laundering each carrying up to 20 years in prison and German authorities have also charged him with related concealment money laundering offenses punishable by up to five years. Prosecutors say Andresen, who allegedly operated under the Speedstepper handle, accessed dormant Dream Market cryptocurrency wallets in November and December 2022, moved millions in commission payments into new wallets, used a Georgia based cryptocurrency service provider in August 2023 to purchase gold bars shipped to his German home, and is accused of laundering over 2 million dollars between August 2023 and April 2025. During searches on May 7, 2026, German authorities recovered approximately 1.7 million dollars in gold bars, more than 23,000 dollars in cash, and evidence of bank accounts and cryptocurrency wallets holding about 1.2 million dollars in suspected Dream Market proceeds.
High-Severity Vulnerability Patched in VMware Fusion

www.securityweek.com · 2 months ago

Broadcom released an update for VMware Fusion to patch a high severity vulnerability. The flaw, tracked as CVE-2026-41702 and rated important by the vendor, is a time of check time of use vulnerability in a SETUID binary that could allow a local non administrative user to escalate privileges to root. The advisory does not report in the wild exploitation, and VMware may issue additional patches as its products face scrutiny at the Pwn2Own hacking competition in Berlin.
Langflow CVE-2026-33017 Exploited to Steal AWS Keys, Deploy NATS Worker

gbhackers.com · 2 months ago

Langflow instances unpatched against CVE-2026-33017 are being actively exploited to achieve unauthenticated arbitrary Python execution that exposes environment variables and application secrets, including AWS access keys. Attackers have used harvested AWS keys to confirm access with sts GetCallerIdentity and to enumerate and interact with services such as Bedrock, S3, EC2, Lambda, and IAM, including attempts to run high cost inference on premium foundation models. Compromised hosts are being enrolled as NATS backed worker nodes in a botnet style infrastructure called KeyHunter that coordinates credential harvesting and validation and uses subject level access control on a hardened NATS server. Defenders are advised to patch Langflow immediately, monitor anomalous AI and Bedrock usage, and treat message brokers like NATS as potential command and control channels.
PoC Released for 18-Year-Old NGINX Flaw Allowing Remote Code Execution

gbhackers.com · 2 months ago

A critical heap buffer overflow in NGINX's rewrite module allows unauthenticated remote code execution, tracked as CVE-2026-42945 with a CVSS v4.0 score of 9.2, and a proof of concept exploit has been publicly released and observed in the wild. The flaw was introduced in NGINX version 0.6.27 in 2008 and affects releases through 1.30.0, can be triggered by crafted HTTP requests containing certain URI characters, and is exploitable without authentication in part because crashed worker processes are automatically restarted with predictable heap layouts. Three additional vulnerabilities were confirmed, CVE-2026-42946, CVE-2026-40701 and CVE-2026-42934, and administrators are urged to upgrade to NGINX 1.31.0 or 1.30.1 immediately or, if unable to upgrade, audit and isolate rewrite and set directive combinations as an interim mitigation.
New Fragnesia Linux flaw lets attackers gain root privileges

www.bleepingcomputer.com · 2 months ago

There is a high severity Linux kernel local privilege escalation vulnerability named Fragnesia, tracked as CVE-2026-46300, that allows unprivileged local attackers to write arbitrary bytes into the kernel page cache of read only files and gain root privileges. William Bowling of V12 Security published a proof of concept that uses a deterministic page cache corruption primitive to modify protected binaries such as /usr/bin/su and spawn a root shell, and the flaw affects kernels released before May 13, 2026. Fragnesia is part of the Dirty Frag vulnerability class and is related to earlier kernel issues tracked as CVE-2026-43284 and CVE-2026-43500, and distributions are issuing patches while administrators are advised to apply kernel updates or temporarily remove or blacklist the esp4, esp6 and rxrpc modules as a mitigation at the cost of breaking IPsec VPNs.
Researcher Drops YellowKey, GreenPlasma Windows Zero-Days

www.securityweek.com · 2 months ago

Two Windows zero day vulnerabilities were publicly released by a researcher known as Chaotic Eclipse, one called YellowKey that enables a BitLocker bypass and another called GreenPlasma that enables elevation to System. YellowKey requires physical access and uses a proof of concept placed on a USB drive or the EFI partition combined with a Windows Recovery Environment sequence to gain access to the protected volume, and it can bypass TPM protections and in some cases TPM PINs. GreenPlasma creates arbitrary memory section objects in writable directory objects to manipulate services and kernel drivers and its published proof of concept is limited but could be extended to achieve full System privileges. Security researchers confirmed the exploits work on recent Windows 11 builds and warned that publicly released proof of concept code could enable rapid weaponization while Microsoft has been contacted for comment.
Packagist Warns: Update Composer Now After GitHub Actions Token Leak

gbhackers.com · 2 months ago

There was a sudden change in GitHub token format that caused Composer to misvalidate certain GitHub Actions tokens and print their full contents to stderr, exposing sensitive authentication tokens in CI logs. Composer versions prior to 2.9.8 rejected the new token format and leaked tokens during failed validation, and patches were released in Composer 2.9.8, Composer 2.2.28 LTS, and Composer 1.10.28 to remove sensitive token values from error messages and to accept the new format. Packagist urges PHP projects to update Composer immediately, review and remove or restrict access to recent CI logs, rotate any potentially leaked credentials, and monitor for suspicious activity while GitHub has temporarily rolled back the token format change.
New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption

thehackernews.com · 2 months ago

A new Linux local privilege escalation vulnerability codenamed Fragnesia, tracked as CVE-2026-46300 with a CVSS score of 7.8, abuses a logic bug in the kernel XFRM ESP-in-TCP subsystem to corrupt the kernel page cache and allow unprivileged local attackers to gain root. The flaw enables arbitrary byte writes into the page cache of read-only files such as /usr/bin/su without requiring race conditions, and a proof of concept exploit has been released showing it yields root on major distributions. Multiple distributions have issued advisories and a patch is available, with recommended mitigations including applying updates, using the same Dirty Frag mitigations such as disabling esp4 and esp6 and restricting local shell access, hardening container workloads, and increasing monitoring for abnormal privilege escalation activity.
New Exim BDAT GnuTLS Vulnerability Enables Code Execution Attacks

gbhackers.com · 2 months ago

There is a critical use after free memory corruption vulnerability in Exim's BDAT message body handling when compiled with the GnuTLS backend that can enable remote code execution. The issue is tracked as EXIM-Security-2026-05-01.1 with a CVE pending and affects Exim builds from 4.97 through 4.99.2; it is triggered by sending a TLS close notify during an active BDAT transfer and immediately following with a single cleartext byte on the same TCP connection, which corrupts heap memory. There are no known mitigations other than upgrading, and maintainers released a fix on May 12, 2026 requiring updates to Exim version 4.99.3 to prevent stale pointer access during TLS teardown.
MongoDB Security Flaw Enables Arbitrary Code Execution on Vulnerable Systems

gbhackers.com · 2 months ago

There is a severe vulnerability in MongoDB, tracked as CVE-2026-8053, that could allow attackers to execute arbitrary code on self-hosted MongoDB Server deployments running supported versions 5.0 and later. MongoDB has patched its managed Atlas cloud fleet and released updated Community and Enterprise server builds including versions 7.0.31, 8.0.20, and 8.2.7 for on-premises users. No evidence of active exploitation has been reported to date. Administrators should immediately audit self-hosted deployments, review release notes, obtain official patched builds, and apply updates during the next maintenance window to prevent data theft, persistent malware, ransomware, or lateral movement.
Gentlemen RaaS Exploits Fortinet and Cisco Edge Devices for Initial Access

gbhackers.com · 2 months ago

There are widespread campaigns by the Gentlemen ransomware as a service operation that turn exposed Fortinet and Cisco edge devices into initial access vectors, with activity scaling from mid 2025 to early 2026 and hundreds of victims reported. Affiliates gain access by brute forcing web or VPN panels, exploiting known vulnerabilities including CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073, or buying access from brokers, then abuse NTLM relay and deploy EDR bypass tools to escalate and move laterally. After compromising edge devices they map Active Directory, abuse certificates and relayable paths to gain domain level access, exfiltrate data via Cloudflare tunnels and custom VPNs, and then deploy a custom ransomware locker, so organizations should patch management interfaces, harden VPN authentication, and eliminate NTLM relay exposure.
18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE

thehackernews.com · 2 months ago

Cybersecurity researchers disclosed multiple vulnerabilities affecting NGINX Plus and NGINX Open Source, including an 18 year old heap buffer overflow in the ngxhttprewritemodule tracked as CVE-2026-42945 with a CVSS v4 score of 9.2 that can allow unauthenticated remote code execution or cause denial of service. The flaw is triggered by a rewrite directive that uses unnamed PCRE captures with a replacement string containing a question mark followed by another rewrite, if, or set directive, and it can be exploited with a single crafted HTTP request. Three additional flaws were patched, including CVE-2026-42946 in the scgi and uwsgi modules, CVE-2026-40701 in the ssl module, and CVE-2026-42934 in the charset module, each of which can disclose memory or restart worker processes under specific configurations. Administrators are advised to install the fixed releases or, if immediate patching is not possible for CVE-2026-42945, replace unnamed captures with named captures in affected rewrite directives as a mitigation.
Foxconn Hit by Cyberattack, Nitrogen Ransomware Gang Claims Involvement

gbhackers.com · 2 months ago

Foxconn confirmed a major cyberattack against its North American operations after the Nitrogen ransomware gang listed the company on its extortion portal and claimed to have stolen about eight terabytes and more than eleven million files. Samples of the stolen material include financial documents from the Houston plant, integrated circuit documentation, temperature sensor data, circuit board layouts and network topology maps tied to projects for AMD, Intel and Google, and operations at Mount Pleasant, Wisconsin and Houston, Texas were disrupted with some staff reverting to pen and paper while incident response teams worked to maintain production. Nitrogen, active since 2023 and reportedly built from leaked Conti version two source code with links to the ALPHV BlackCat ecosystem, uses a double extortion model and Foxconn says affected factories are resuming normal production while declining to confirm whether customer data was compromised, making this at least the third major ransomware incident to hit the company.
Hunting the Behavior Behind npm Supply Chain Attacks

derivai.substack.com · 2 months ago

There are rising npm supply chain attacks affecting projects such as TanStack, Axios, Trivy, Bitwarden, SAP, and Intercom, and on May 11, 2026 between 19:20 and 19:26 UTC a threat actor published 84 malicious versions across 42 TanStack packages that carried valid SLSA provenance and were live for roughly four hours. There is an AI assisted hunting pipeline that focuses on the behavioral kill chain instead of chasing indicators of compromise, using deep research to build a corpus and converting that corpus into SIEM hunt queries targeted at platforms like CrowdStrike LogScale. Detection anchors include npm lifecycle environment variables, process ancestry to node, in memory evaluation patterns, LOLBIN abuse, payload write then execution in temporary paths, and persistence registration, organized into ten tiers with credential theft and in memory eval prioritized. Sensor field coverage varies by platform, rules must be tuned to reduce false positives, recommended cadences for time critical tiers start at every 15 minutes, and teams are warned not to deploy AI generated playbooks without validation because SIEM query volume and tuning cost are significant.