Blahalla

PATCHCORD Infrastructure Hosts SuperShell C2 for Remote Commands and Webshell Management

gbhackers.com · 2 months ago

A newly uncovered espionage operation targeting Afghan telecom providers and South Asian critical infrastructure has exposed a layered attacker ecosystem built around custom implants, spoofed delivery portals, cloud-backed command-and-control channels. The campaign began with sector-specific social-engineering lures, including a malicious Inno Setup package named TMSAfghanTelecom.

AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions

www.securityweek.com · 2 months ago

The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies.

Hackers Steal One AI Key, Resell the Compute, and Leave Victims With a Million-Dollar Bill

gbhackers.com · 2 months ago

A rapidly expanding financial cybercrime model called AI token jacking, where threat actors steal developer API keys for popular AI platforms, consume the victim’s allocated model capacity, and resell that compute through gray-market proxy services. The term “token” in this context does not refer to a browser session token.

Fortinet FortiWeb and FortiClient Flaws Let Unauthenticated Attackers Gain Access and Execute Arbitrary Code

gbhackers.com · 2 months ago

Fortinet has released security updates to address high-severity vulnerabilities in FortiWeb and FortiClient for Windows. These vulnerabilities could allow unauthenticated attackers to access appliance administration interfaces or execute arbitrary code.

Aeternum Hides Malware Commands on Polygon Blockchain Where Server Takedowns Can’t Erase Them

gbhackers.com · 2 months ago

A newly analyzed malware operation called Aeternum is turning the public Polygon blockchain into a command-and-control (C2) channel, allowing attackers to distribute botnet instructions without relying on a conventional server or domain.

Trezor Shipping Provider Data Breach Exposes Personal Data of 13,689 Customers

gbhackers.com · 2 months ago

Hardware wallet manufacturer Trezor has recently disclosed a data breach at ShipMonk, a third-party shipping provider. This breach exposed the personal information of 13,689 customers. Importantly, Trezor’s internal systems, hardware wallets, private keys, wallet backups, and cryptocurrency holdings were not compromised.

Beacon CRM Data Breach Exposes Customer Data via Compromised AWS Access Key

gbhackers.com · 2 months ago

Beacon CRM has confirmed that a threat actor likely downloaded a complete copy of its customer database after gaining access to its Amazon Web Services (AWS) environment using a compromised AWS access key.

New AmnesiaStealer Malware Targets macOS Users via ClickFix Attacks

gbhackers.com · 2 months ago

A newly identified macOS infostealer, named AmnesiaStealer, targets users via ClickFix social-engineering campaigns that impersonate GitHub download pages. This malware combines various malicious features, including password theft, browser data collection, persistence, and the hidden remote control of authenticated Chromium browser sessions.

5 key takeaways from Black Hat USA 2026

www.csoonline.com · 2 months ago

AI’s potential as a security tool and the danger of autonomous AI agents as a new attack surface were key themes of the presentations and product announcements at Black Hat and DEFCON in Las Vegas last week. Here are some key takeaways from this year’s hacker summer camp that CISOs should review while developing cybersecurity strategies.

Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks

www.bleepingcomputer.com · 2 months ago

You're not alone if you just received an "Apple Threat Notification" saying it detected a "mercenary spyware attack targeted at your iPhone."

Judge Affirms Settlement Allowing HPE’s Deal for Juniper

www.nytimes.com · 2 months ago

States had opposed an agreement allowing a Hewlett Packard Enterprise acquisition, calling the settlement ineffective and corrupt.

Ukraine shuts down 94 fraudulent call centers, seize millions in cash

www.bleepingcomputer.com · 2 months ago

Authorities in Ukraine shut down 94 fraudulent call centers across the country that lured people into investment scams or tried to obtain access to bank accounts.

Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt

www.bleepingcomputer.com · 2 months ago

An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking.

Global Threat Campaign Hits Critical VMware vCenter Flaw

www.darkreading.com · 2 months ago

Exploitation against CVE-2026, 59310 began earlier this month, and patching the vulnerability may not be enough to fully mitigate the threat.

Attackers target zero-day vulnerability in geospatial data platform GeoServer

www.csoonline.com · 2 months ago

Security researchers have seen evidence that attackers are attempting to exploit a currently unpatched SQL injection vulnerability in GeoServer, an open-source web server for managing and publishing geospatial data.

CSS:the bomb inside your inbox

portswigger.net · 2 months ago

Gareth Heyes detailed research showing how attackers exploit webmail sanitizers using CSS to bypass security controls. He demonstrated techniques that abuse allowed HTML/CSS properties across multiple clients, including Outlook and Fastmail. These attacks allow compromising accounts, stealing passwords through spoofed login UIs, and exfiltrating tokens even when CSP blocks external resources.

Another OpenAI Executive, Denise Dresser, Departs the A.I. Start-Up

www.nytimes.com · 2 months ago

Former Slack CEO Denise Dresser recently left the artificial intelligence start-up, OpenAI. Her departure joins a recent string of high-profile executives leaving the company.

Hackers breach govt webmail while running parallel crypto fraud

www.bleepingcomputer.com · 2 months ago

Jewelbug hit Middle East governments via webmail compromise using dual espionage/crypto fraud. They deployed scripts like Antino, stealing credentials and cookies. Over 580,000 browser cookies were found in victim data infrastructure.

Microsoft patches LegacyHive Windows zero-day vulnerability

www.bleepingcomputer.com · 2 months ago

Microsoft released patches for the LegacyHive zero-day vulnerability, which impacts the Windows User Profile Service. Attackers could leverage this flaw using a crafted application to gain local administrator privileges without requiring user interaction. Microsoft tracks this successful patch as CVE-2026-62832.

AI 'watermark removers' flood the web. Almost none can prove they work.

www.bleepingcomputer.com · 2 months ago

Anthropic began watermarking text generated by Claude, prompting the emergence of multiple "watermark remover" web tools and GitHub projects. These services claim they defeat the invisible markings but operate without verifiable evidence or public testing mechanisms. Users cannot confirm efficacy because Anthropic has not released a detector model or disclosed how it implemented its watermark.

Critical VMware vCenter RCE flaw exploited for reverse SSH access

www.bleepingcomputer.com · 2 months ago

VMware vCenter vulnerability CVE-2026-59310 (directory traversal) allows unauthenticated RCE via reverse SSH tools. Attackers compromised 361 IPs globally. Patching and using QUIRSO's YARA rule are recommended.

What 50 open source projects taught us about security in the AI era

github.blog · 2 months ago

The GitHub Secure Open Source Fund showcased how open source projects enhanced security using AI-assisted workflows, expert guidance, and maintainer expertise. Participants leveraged GitHub security tools to improve code robustness across various systems. The initiative detailed critical lessons learned from 50 open source projects regarding modern security practices in the AI era.

From Unauthenticated API to Grid Risk: A Hybrid Inverter Vulnerability Explained

www.saiflow.com · 2 months ago

Researchers discovered an unauthenticated vulnerability in the FIMER React 2 hybrid inverter. This misconfiguration allows attackers to remotely issue commands over the CAN bus directly to internal components like the Supervisor and Digital Signal Processors. Exploiting this flaw risks physical device damage, permanent Denial-of-Service, and endangers grid technicians.

Trezor discloses data breach affecting nearly 14,000 customers

www.bleepingcomputer.com · 2 months ago

Hardware wallet manufacturer Trezor disclosed a data breach affecting nearly 14,000 customers after ShipMonk suffered unauthorized access. The incident exposed customer order data, including full names and addresses for orders placed between May 10 and August 8, 2026. The company warns affected users to guard against phishing attempts exploiting the leaked personal details.

Cybersecurity M&A Roundup: 21 Deals Announced in July 2026

www.securityweek.com · 2 months ago

Major cybersecurity firms announced numerous M&A deals in July 2026. Barracuda acquired Evo Security to boost its multi-tenant IAM capabilities, while Cribl purchased CardinalOps to improve automated detection engineering for SOCs. Other deals include Cyera acquiring Oasis Security and Okta acquiring Permiso Security for continuous identity threat detection.

Adobe Commerce Bug Targeted Immediately After Disclosure

www.securityweek.com · 2 months ago

Sansec found unauth attackers hit Adobe Commerce via CVE-2026-71362 post-patch disclosure. Remote exploit allows privilege escalation and session hijacking for all versions up to July 2026. Adobe must apply an isolated fix.

Who Vets AI’s Code? The Scale Challenge Facing Open Source Ingestion

www.bleepingcomputer.com · 2 months ago

AI coding assistants speed up development but create supply-chain risk via unvetted open-source dependencies and slopsquatting on registries like PyPI/npm. Organizations must govern package selection upon import.

Jewelbug Uses Public Google Docs as Malware Command-and-Control Delivery Channel

gbhackers.com · 2 months ago

The China-linked group Jewelbug compromised public Google Docs to create a command-and-control channel. They embed obfuscated malware payloads that victim implants fetch and execute after decoding content using XOR encoding. The operators manage these campaigns via the XG-Web platform, supplementing their tactics with typosquatted domains in watering-hole attacks against government networks.

White House taps security firms for offensive hack-back operations

www.bleepingcomputer.com · 2 months ago

Trump signed memo for offensive cyber program. Vetted firms can target foreign ransomware/fraud groups. Firms need Dept. approval and a $1M bond.

AI agents wage near-autonomous cyberattack on Asian government networks

www.csoonline.com · 2 months ago

Researchers reported a multi-day, near-autonomous cyberattack utilizing open-source AI agents built on frameworks like Hermes and OpenClaw. These parallel agents probed interconnected government systems across Asia over four days, compromising credentials and exfiltrating thousands of records. This research signals that AI enables intrusion campaigns, lowering the cost for offensive operations.

DentaQuest Breach Affects 15 Million in Largest US Health Data Breach Reported in 2026

www.techrepublic.com · 2 months ago

DentaQuest reported a network breach discovered May 20, 2026, impacting potentially over 15 million individuals. The cyberattack compromised sensitive data between May 17 and May 20, stealing Social Security numbers, names, addresses, and detailed dental or vision health records. Extortion group ShinyHunters claimed responsibility for the leak of this vast dataset.

Flock unveils changes after Post report on police misuse of its network

www.washingtonpost.com · 2 months ago

License-plate-reader firm Flock announced major policy changes after a Washington Post investigation revealed dozens of officers misused its cameras for personal spying. The company will now require law enforcement to label every search with a criminal case number using the roadside camera network data. Furthermore, Flock will automatically review all searches for "abnormal activity."

Microsoft Exchange Server Vulnerabilities Allow DoS, Privilege Escalation, and RCE

gbhackers.com · 2 months ago

Microsoft released updates addressing six critical vulnerabilities in Exchange Server, including those allowing remote code execution and privilege escalation. The most severe flaw is CVE-2026-62913, an RCE vulnerability caused by a heap overflow. Organizations must patch these flaws immediately, which include CVE-2026-62910 through the 6291x series (e.g., CVE-2026-62911 and CVE-2026-62912).

WordPress 7.0.4 Patches Remote Code Execution Vulnerability

www.securityweek.com · 2 months ago

WordPress issued patches for CVE-2026-65640, a high-severity vulnerability allowing remote code execution via malicious Postscript files. Attackers needed Author-level user permissions to exploit the flaw by uploading these specialized files as standard images. The weakness results from ImageMagick and Ghostscript improperly handling file content within WordPress's image processing pipeline.

Microsoft’s August Patch Tuesday: 400+ Bugs Fixed, One Zero-Day Already Under Attack

www.techrepublic.com · 2 months ago

Microsoft patched over 400 flaws, fixing zero-day CVE-2026-68820 (local privilege escalation to SYSTEM) exploited by North Korea via Operation Dream Job targeting afd.sys. Other fixes include CVE-2026-62878 (DNS Server), CVE-2026-62832, CVE-2026-62893, CVE-2026-59124, and CVE-2026-62815.

Critical Dell VMware vSphere Client Flaw Lets Remote Attackers Execute Commands as Root

gbhackers.com · 2 months ago

Dell disclosed a critical vulnerability, tracked as CVE-2026-67261, in its Virtual Storage Integrator for VMware vSphere Client. This flaw permits unauthenticated remote attackers to execute arbitrary operating system commands with root privileges through an OS command injection weakness. Organizations must immediately upgrade affected deployments of VSI before version 10.11.1.0.

Trump administration opens door to private-sector cyber offensives

www.csoonline.com · 2 months ago

Trump admin allows vetted US companies cyber ops vs foreign threats. Program needs DoJ or DHS contracts. Experts warn of collateral damage and accountability risks for these operations.

Trump Administration Authorizes Cyber Operations Against Foreign Criminal Networks

gbhackers.com · 2 months ago

A new memo allows US private companies government cyber surveillance against foreign criminal groups (CE-TCOs). This expands EO 14390 to disrupt botnet C2 and ransomware ecosystems, overseen by DOJ/DHS at the NCC.

Can AI do novel security research? Meet the HTTP Terminator

portswigger.net · 2 months ago

James Kettle researched whether autonomous systems can invent attack techniques for live websites. He successfully used automated methods to discover HTTP desync triggers, gadgets, and exploits compromising banking and government infrastructure. This research presents a blueprint for developing autonomous security research and opens the findings through the HTTP Terminator tool.

It took $58 to break Microsoft’s SCCM, but a patch made it harder

www.csoonline.com · 2 months ago

Researchers at XM Cyber found an attack chaining multiple flaws allowing a standard domain user to achieve remote code execution on Microsoft SCCM. The method uses vulnerabilities in AdminService upload functions, CabSlip, and weak certificate validation, escalating privileges to SYSTEM level. This chain remains viable through secondary paths until ConfigMgr 2609 provides full remediation.

LiteLLM Hack Exposes Secrets From 2,488 Companies Across 118,829 CI Runner Dumps

gbhackers.com · 2 months ago

TeamPCP executed a supply-chain compromise via LiteLLM, changing a malicious package incident into an enterprise secrets exposure event. The attackers used versions 1.82.7 and 1.82.8 to run payloads during interpreter initialization, gathering critical data like cloud credentials and API keys. Researchers linked runner dumps across corporate domains, showing the risk in build environments.

WhatsApp rolls out new feature that flags potential scam messages

www.bleepingcomputer.com · 2 months ago

WhatsApp launched optional Scam Alert via local ML to warn on scam messages by analyzing non-contact incoming messages without sending data off-device. This adds to existing defenses against fraud and spyware like Pegasus.

A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months

www.helpnetsecurity.com · 2 months ago

Researchers at Reco tracked the City-Forum campaign, detailing how attackers pull records from Salesforce and ServiceNow portals globally. These attacks utilize anonymous guest users without exploiting vulnerabilities or needing credentials. The activity exploits mandatory "guest user" profiles that expose publicly configured data intended only for limited access.

America Wants to Make Its Own Humanoid Robots. That Won’t Be Easy.

www.nytimes.com · 2 months ago

China manufactures humanoid robots by the thousands. Meanwhile, new generations of U.S. start-ups are entering the market, aiming to compete in the rapidly growing sector.

CISA Adds Actively Exploited Windows WinSock Vulnerability to KEV Catalog

gbhackers.com · 2 months ago

CISA added CVE-2026-68820, a critical local privilege escalation flaw in the Windows Ancillary Function Driver for WinSock, to its Known Exploited Vulnerabilities catalog. This use-after-free vulnerability allows an authorized local attacker to elevate privileges on vulnerable systems. Organizations must prioritize fixing this high-risk issue before CISA's remediation deadline of August 25, 2026.

Separating AI’s Technological Problems from Its Capitalism Problems

www.schneier.com · 2 months ago

Users must distinguish AI's technological flaws from deep systemic, capitalist problems. Developers addressed technical issues like hallucinations but largely ignore societal requirements, such as environmental impact and equitable resource allocation. Major models thus prioritize seeming competent to users rather than ensuring broad public benefit or structural fairness.

Wireshark 4.6.8 Released to Patch 28 Security Vulnerabilities

gbhackers.com · 2 months ago

Wireshark 4.6.8 patches 28 flaws causing crashes/DoS analyzing crafted traffic in Kerberos, SSH, RDP, & Bluetooth dissectors. It also secures pcapng/TTX Logger file parsing. This update strengthens analysis for all users.

Armored Likho Turns Windows Microphones Into Automated Eavesdropping Devices

gbhackers.com · 2 months ago

Armored Likho, also known as Eagle Werewolf, expanded its espionage capabilities with a Rust-based Still Toolkit. The malware targets Russian entities using fraudulent donation applications to hijack Telegram sessions and compromise Windows systems. It transforms endpoints into automated audio surveillance devices, gathering system identifiers and retrieving conversations via the Telegram API.

Fortinet Patches Authentication Flaws in FortiWeb and FortiManager

www.securityweek.com · 2 months ago

Fortinet patched 8 high-severity bugs: CVE-2026-26035 (unauth login), CVE-2026-70468 (impersonation), CVE-2026-70465 (Win overflow), and CVE-2026-49975 (HTTP/2 Bomb). Patches affect products like FortiWeb and FortiManager.

Cloudflare Mitigates 23.2 Million DDoS Attacks as 1 Tbps Attacks Surge 519%

gbhackers.com · 2 months ago

Cloudflare reported mitigating 23.2 million network-layer DDoS attacks and stopping 29.64 trillion HTTP requests during the first half of 2026. The company noted a 519% surge in hyper-volumetric campaigns that exceeded one terabit per second, recording 935 such events. Additionally, DNS floods emerged as the dominant network-layer threat category, accounting for 34.3% of total activity.