Blahalla

LiteLLM Hack Exposes Secrets From 2,488 Companies Across 118,829 CI Runner Dumps

gbhackers.com · 2 months ago

TeamPCP executed a supply-chain compromise via LiteLLM, changing a malicious package incident into an enterprise secrets exposure event. The attackers used versions 1.82.7 and 1.82.8 to run payloads during interpreter initialization, gathering critical data like cloud credentials and API keys. Researchers linked runner dumps across corporate domains, showing the risk in build environments.

WhatsApp rolls out new feature that flags potential scam messages

www.bleepingcomputer.com · 2 months ago

WhatsApp launched optional Scam Alert via local ML to warn on scam messages by analyzing non-contact incoming messages without sending data off-device. This adds to existing defenses against fraud and spyware like Pegasus.

A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months

www.helpnetsecurity.com · 2 months ago

Researchers at Reco tracked the City-Forum campaign, detailing how attackers pull records from Salesforce and ServiceNow portals globally. These attacks utilize anonymous guest users without exploiting vulnerabilities or needing credentials. The activity exploits mandatory "guest user" profiles that expose publicly configured data intended only for limited access.

America Wants to Make Its Own Humanoid Robots. That Won’t Be Easy.

www.nytimes.com · 2 months ago

China manufactures humanoid robots by the thousands. Meanwhile, new generations of U.S. start-ups are entering the market, aiming to compete in the rapidly growing sector.

CISA Adds Actively Exploited Windows WinSock Vulnerability to KEV Catalog

gbhackers.com · 2 months ago

CISA added CVE-2026-68820, a critical local privilege escalation flaw in the Windows Ancillary Function Driver for WinSock, to its Known Exploited Vulnerabilities catalog. This use-after-free vulnerability allows an authorized local attacker to elevate privileges on vulnerable systems. Organizations must prioritize fixing this high-risk issue before CISA's remediation deadline of August 25, 2026.

Separating AI’s Technological Problems from Its Capitalism Problems

www.schneier.com · 2 months ago

Users must distinguish AI's technological flaws from deep systemic, capitalist problems. Developers addressed technical issues like hallucinations but largely ignore societal requirements, such as environmental impact and equitable resource allocation. Major models thus prioritize seeming competent to users rather than ensuring broad public benefit or structural fairness.

Wireshark 4.6.8 Released to Patch 28 Security Vulnerabilities

gbhackers.com · 2 months ago

Wireshark 4.6.8 patches 28 flaws causing crashes/DoS analyzing crafted traffic in Kerberos, SSH, RDP, & Bluetooth dissectors. It also secures pcapng/TTX Logger file parsing. This update strengthens analysis for all users.

Armored Likho Turns Windows Microphones Into Automated Eavesdropping Devices

gbhackers.com · 2 months ago

Armored Likho, also known as Eagle Werewolf, expanded its espionage capabilities with a Rust-based Still Toolkit. The malware targets Russian entities using fraudulent donation applications to hijack Telegram sessions and compromise Windows systems. It transforms endpoints into automated audio surveillance devices, gathering system identifiers and retrieving conversations via the Telegram API.

Fortinet Patches Authentication Flaws in FortiWeb and FortiManager

www.securityweek.com · 2 months ago

Fortinet patched 8 high-severity bugs: CVE-2026-26035 (unauth login), CVE-2026-70468 (impersonation), CVE-2026-70465 (Win overflow), and CVE-2026-49975 (HTTP/2 Bomb). Patches affect products like FortiWeb and FortiManager.

Cloudflare Mitigates 23.2 Million DDoS Attacks as 1 Tbps Attacks Surge 519%

gbhackers.com · 2 months ago

Cloudflare reported mitigating 23.2 million network-layer DDoS attacks and stopping 29.64 trillion HTTP requests during the first half of 2026. The company noted a 519% surge in hyper-volumetric campaigns that exceeded one terabit per second, recording 935 such events. Additionally, DNS floods emerged as the dominant network-layer threat category, accounting for 34.3% of total activity.

6,330 Internet-Exposed ICS Devices Near U.S. Data Centers Put Cooling and Power Systems at Risk

gbhackers.com · 2 months ago

6,300+ exposed ICS/BAS devices near 1,063 US data centers risk disruption via BACnet and Niagara. Exploits could cause physical availability issues for cooling/power.

'Jewelbug' APT Balances State Espionage & Cryptocurrency Theft

www.darkreading.com · 2 months ago

APT group "Jewelbug," from China, spies/steals crypto using C2 panel. Malware includes Windows backdoor Antino & Linux backdoor ClientKing, plus PDF Viewer extension. Data stolen: cookies, tokens. Attackers use AI for fake crypto phishing.

Galaxy Z Fold 8 Is Getting Android’s New Tap-to-Share Quick Share Feature

www.techrepublic.com · 2 months ago

Google expands its tap-to-share Quick Share feature to Samsung Galaxy Z Fold 8 and Ultra. This new functionality uses NFC and device proximity to facilitate faster sharing of photos, files, and contacts between compatible phones. Additionally, the feature allows IT departments an alternative data transfer method for managed corporate devices running Android 17 and One UI 9.

White House Mobilizes Security Firms for Operations Against Foreign Cybercrime Gangs

www.securityweek.com · 2 months ago

Presidential memo authorizes vetted US private companies for cyber ops against foreign criminal groups via National Coordination Center. Operations require DOJ/DHS bonds, focusing only on intelligence gathering or system disruption.

Two Parsers, One JSON and a Flag: Intigriti's July 2026 Challenge

blog.himanshuanand.com · 2 months ago

Intigriti CTF found a JSON manifest parser flaw. Submitting duplicate package keys allowed exploitation. Signer used the first key; report generator accessed unowned scopes via the last key. Researchers extracted a flag.

Critical VMware vCenter Vulnerability in Attackers’ Crosshairs

www.securityweek.com · 2 months ago

Exploiting a critical directory traversal bug in VMware vCenter’s Syslog server allows remote code execution. A security firm reported an entity actively exploited this flaw starting around August 3, utilizing the vulnerability for persistence across 47 countries. Attackers maintain control by dropping reversessh after initial compromise.

www.nytimes.com · 2 months ago

Pangram successfully distinguishes text generated by chatbots from human writing. However, the system proved unreliable when attempting to spot artificially created images. Researchers noted this limitation in current AI detection technology.

Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’

www.securityweek.com · 2 months ago

Researcher Nightmare Eclipse released ShieldBreak, a zero-day exploit targeting Microsoft Defender to escalate user privileges on Windows systems. The PoC leverages CVE-2026-50656, which exploits a race condition flaw in Defender allowing System privilege access. Experts caution that this attack method differs substantially from previous exploits like RoguePlanet.

Critical Adobe Commerce Flaw Lets Unauthenticated Attackers Escalate Privileges

gbhackers.com · 2 months ago

Adobe patched Commerce/Magento for critical flaws: unauth privilege escalation (CVE-2026-71362), XSS (CVE-2026-48413/CVE-2026-48414), & others (CVE-2026-48415, CVE-2026-48416). Upgrade to August 2026 builds immediately.

Microsoft wants you to rethink your approach to cyber defense

www.csoonline.com · 2 months ago

Microsoft's David Weston showed AI tools can cheaply find exploits. Using MDASH, the tool found 200 Linux kernel CVEs and generated 182 root-level PoCs. Automatic exploit creation is becoming common, requiring focus on system resilience instead of just patching.

WhatsApp Introduces On-Device Scam Alert to Detect Fraud Messages

gbhackers.com · 2 months ago

WhatsApp launched Scam Alert on-device ML detection for non-contacts' fraudulent messages while maintaining E2EE. Content stays local. Meta increased security via public model versions on a transparency ledger and anonymous credential downloads.

Adobe ColdFusion Critical Vulnerabilities Enable Arbitrary Code Execution

gbhackers.com · 2 months ago

Adobe patched ColdFusion 2025/2023 for 17 P1 flaws. Key fixes include CVE-2026-48362 (OS command execution), CVE-2026-48273 (eval injection), and auth failures in CVE-2026-71384, -71386, & -71387. Updates are critical for users.

Akira Ransomware Reboots Windows Into Safe Mode to Disable EDR and Microsoft Defender

gbhackers.com · 2 months ago

Akira ransomware hit SonicWall SSL VPN via lack of MFA credentials. They stole data by dumping AD records and exfiltrating mapped shares to an S3 bucket using double extortion. Attackers bypassed defenses by entering Safe Mode with Networking, disabling Microsoft Defender and anti-EDR protection.

Gunra Ransomware Uses Up to 100 ChaCha20 Threads to Rapidly Encrypt Linux Systems

gbhackers.com · 2 months ago

Gunra ransomware used CVE-2024-55591 & CVE-2025-24472 to launch up to 100 threads, encrypting data with ChaCha20/RSA-4096. This Ransomware-as-a-service is derived from Conti source code.

Belgium's eID Authentication Opens Citizen Accounts to RCE

www.darkreading.com · 2 months ago

A researcher revealed severe vulnerabilities in the Connective browser extension supporting Belgium's electronic ID authentication framework. These flaws compromised citizen identities and payment data, potentially enabling attackers to perform Remote Code Execution (RCE). The incident shows security weaknesses in critical web browser extensions used for national systems.

Kimwolf v7 Removes Exploitation Code and Leaves Infection to External Loaders

gbhackers.com · 2 months ago

Kimwolf v7 is a DDoS payload needing external loaders. It uses HTTP/2 floods mimicking Chrome via browser fingerprints, optimized UDP for ARM NEON, and hard-coded ETH RPCs for resilient C2.

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

thehackernews.com · 2 months ago

Exploitation of Microsoft SharePoint vulnerability CVE-2026-55040, a weakness allowing security feature bypass via weak authentication, was possible after a proof-of-concept release. Attackers used this flaw, which carries a CVSS score of 9.1. Microsoft patched the vulnerability as part of its July 2026 Patch Tuesday updates.

China-Linked Hackers Use Autonomous AI Agents to Breach Taiwan Government Systems

gbhackers.com · 2 months ago

China-linked group targeted Taiwan gov't (July 1-4/2026) using AI framework (Hermes/OpenClaw). They compromised 85 accounts across 21 SSO systems via API enumeration and JWT algorithm none exploits, exfiltrating records.

Phantom Stealer Uses PNG Steganography and PowerShell Injection to Steal Credentials

gbhackers.com · 2 months ago

Phantom Stealer is a.NET malware harvesting credentials, browser data, and cryptocurrency wallets using stealth techniques. The malware conceals payloads via PNG steganography and executes code by injecting into explorer.exe using PowerShell. Furthermore, it patches critical functions like AmsiScanBuffer and EtwEventWrite to suppress telemetry, complicating detection efforts.

City-Forum Hackers Target Salesforce and ServiceNow Instances Worldwide for Data Theft

gbhackers.com · 2 months ago

A threat campaign named "City-Forum" targets publicly accessible Salesforce Experience Cloud sites and ServiceNow Service Portals. Security firm Reco identified that the operation exploits records, metadata, and portal functions exposed to unauthenticated guest users. The attackers employ a custom toolset, leveraging Aura endpoints and LWR GraphQL APIs rather than known platform vulnerabilities.

Palo Alto GlobalProtect Vulnerabilities Enable SYSTEM and Root-Level Access

gbhackers.com · 2 months ago

Palo Alto Networks issued advisories detailing multiple vulnerabilities in GlobalProtect App versions 6.0, 6.2, and 6.3. These flaws allow local attackers to elevate privileges to SYSTEM on Windows or root on Linux/macOS systems via CVE-2026-0299. The report outlines related issues including CVE-2026-0298 (Windows code execution) and CVE-2026-0297 (buffer overflow), alongside CVE-2026-0296.

WordPress RCE Vulnerability Lets Authenticated Authors Execute Remote Code

gbhackers.com · 2 months ago

WordPress released version 7.0.4 to address CVE-2026-65640, an authenticated Remote Code Execution vulnerability. The flaw allows users with Author-level privileges or higher to execute code when WordPress processes files using Imagick and Ghostscript extensions. Administrators must urgently update installations to mitigate the risk associated with file uploads in multi-author environments.

Smashing Security podcast #480: This is the AI service you should never sign up to

grahamcluley.com · 2 months ago

The Smashing Security podcast discussed two phishing threats targeting users. Attackers utilize "Greatness," a platform that bypasses traditional security measures by leveraging only real Microsoft login pages to steal credentials. Researchers also cautioned about "Poison Claude," a fraudulent service offering access to Anthropic's Claude at heavily discounted rates.

"City-Forum" data-theft attacks target Salesforce, ServiceNow portals

www.bleepingcomputer.com · 2 months ago

A data theft campaign named City-Forum targets Salesforce Experience Cloud and ServiceNow portals by exploiting overly permissive guest user access. Attackers use custom tools to enumerate records and steal data exposed to anonymous users rather than targeting known vulnerabilities. Researchers tracked this threat using the IP address 158.220.87.79, observing activity through endpoints like Aura.

Android malware combo takes out loans and relays victims' credit cards

www.bleepingcomputer.com · 2 months ago

Group-IB investigated an attack involving WindRelay malware combined with the SpyNote remote administration tool RAT. A fraudster socially engineered a victim into installing SpyNote, granting attackers remote device access over a phone call. They then used WindRelay to act as a fraudulent contactless reader, relaying live NFC card data for approving loans and purchases.

Long-running Data Theft Campaign Targeting Salesforce, ServiceNow

www.darkreading.com · 2 months ago

An unknown group launched the "City-Forum" campaign since March 2025, targeting global instances of Salesforce and ServiceNow across multiple sectors. Researchers at Reco report the attacker uses custom tools to exploit overly permissive guest access through both platforms. This technique allows data retrieval from newer interfaces like Lightning Web Runtime (LWR) and obscure service portals.

Researcher bypasses Microsoft Defender security patch, seizing control

www.csoonline.com · 2 months ago

Researcher Nightmare Eclipse released ShieldBreak, a proof of concept bypassing a recent Microsoft Defender patch for CVE-2026-50656. This exploit allows attackers to achieve system-level control even after organizations apply official remediation measures. Security experts warn that such successful bypasses severely undermine overall trust in vendor-deployed security patches.

Researcher creates workaround for Microsoft Defender security patch

www.csoonline.com · 2 months ago

ShieldBreak PoC shows full system control bypassing MS fix for CVE-2026-50656. Unauthorized users gain system-level privileges, challenging patch integrity. Attackers can exploit this even post-remediation.

Hackers exploit critical Adobe Commerce flaw to hijack customer accounts

www.bleepingcomputer.com · 2 months ago

Sansec found Adobe's Commerce flaw, CVE-2026-71362, lets attackers hijack accounts via session manipulation due to Magento mishandling identity. Adobe patched this plus 5 other CVEs (CVE-2026-48414 et al.).

3 Ex-Georgia Deputies Used Flock Cameras to Stalk People, Sheriff Says

www.nytimes.com · 2 months ago

Former Bibb County deputies faced arrest amid a national debate concerning Flock cameras. These devices monitor roads in every state except Alaska, raising concerns about pervasive surveillance. The controversy highlights the growing discussion around law enforcement's deployment of mass surveillance technology.

Driver Sets Record for Hydrogen-Powered Vehicle at More Than 406 M.P.H.

www.nytimes.com · 2 months ago

Andy Green, a 64-year-old retired Royal Air Force pilot from Britain, was already the only person to break the sound barrier on land. “The ground comes at you very, very quickly,” he said.

Hundreds of fake Chrome VPN extensions route traffic through a proxy

www.bleepingcomputer.com · 2 months ago

Researchers identified over 737 fake Chrome extensions impersonating well-known services like NordVPN and Proton VPN. These deceptive tools routed user traffic through SOCKS5 proxies run by a single provider, potentially capturing all browser activity. The campaign primarily attempted to steal credentials and funnel users into subscription fraud.

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

thehackernews.com · 2 months ago

Check Point Research attributed the North Korean Lazarus Group to exploiting a newly patched flaw in Microsoft Windows. The group delivered a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. This activity constitutes Operation Dream Job, an ongoing cyber espionage effort.

Walmart's "Trusted Agent" Approach to Purple Teaming

www.darkreading.com · 2 months ago

Walmart reconfigured security operations by co-locating red and blue teams to improve defense through collaborative purple teaming exercises. Jason O'Dell shifted the focus from competitive scenarios to a learning environment built on psychological safety and trust. This "trusted agent" model allows both offensive and defensive practitioners to elevate overall organizational skills.

Plug and Pwn attack uses fake USB devices for Windows SYSTEM access

www.bleepingcomputer.com · 2 months ago

Researchers found "Plug and Pwn" exploits for Windows Plug and Play. These abuses allow forcing vulnerable vendor package installs as NT AUTHORITY\\SYSTEM, achieving system privileges remotely via RDP without local access.

Cisco Advance Notification for Publication of August 19, 2026, Security Advisories

sec.cloudapps.cisco.com · 2 months ago

On August 19, 2026, Cisco PSIRT will publish advisories disclosing new vulnerabilities affecting multiple products. Affected devices include Secure Firewall Adaptive Security Appliance, BroadWorks Industrial Ethernet Switches, and Unified Contact Center Enterprise RoomOS. Customers must upgrade to fixed software released in these advisories to fully remediate the reported security risks.

CVE-2026-0298 GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP) (Severity: MEDIUM)

security.paloaltonetworks.com · 2 months ago

Palo Alto Networks found CVE-2026-0298 in GlobalProtect's PLAP, allowing SYSTEM code exec via SAML auth on Windows devices. Upgrade the app for mitigation. Organizations must patch immediately.

CVE-2026-0301 PAN-OS: Information Disclosure Vulnerability in URL Filtering (Severity: LOW)

security.paloaltonetworks.com · 2 months ago

A new information disclosure vulnerability, CVE-2026-0301, affects Palo Alto Networks PAN-OS URL Filtering feature. This flaw allows unauthenticated users with network access to retrieve sensitive data. Palo Alto Networks advises upgrading specific affected versions of PAN-OS and Prisma Access to mitigate the risk.

PAN-SA-2026-0011 Chromium: Monthly Vulnerability Update (August 2026) (Severity: HIGH)

security.paloaltonetworks.com · 2 months ago

Palo Alto Networks released security advisory PAN-SA-2026-0011, detailing Chromium's monthly vulnerability update for August 2026. This update patches numerous flaws, including Use after free and Type Confusion vulnerabilities found in components like GPU and Views. The advisory addresses a wide range of issues across the codebase, covering CVE-2026-13774 through CVE-2026-13822.

CVE-2026-0290 Prisma Browser: Sensitive Information Disclosure Vulnerability (Severity: LOW)

security.paloaltonetworks.com · 2 months ago

Palo Alto Networks released an Aug 2026 update for Chromium, fixing critical flaws including Use after free (CVE-2026-13774, CVE-2026-13782) and Type Confusion (CVE-2026-13776). The patch addresses multiple issues in Extensions and GPU.