Blahalla

Google Chrome 151 Update Fixes 5 High-Severity Use-After-Free Vulnerabilities

gbhackers.com · 2 months ago

Google released Chrome version 151.0.7922.137/138, patching five high-severity Use-After-Free vulnerabilities across V8, Blink, TabStrip, Extensions, and HTML components. These fixes address the critical range of CVE-2026-19556 through CVE-2026-19560. Researcher Jihyeon Jeong reported a flaw, CVE-2026-19556, affecting V8's JavaScript engine.

Chipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined

www.securityweek.com · 2 months ago

Intel dropped 42 advisories for 72 flaws in PROSet/Wireless WiFi and Xeon, patching privilege escalation/DoS risks. AMD issued five high-severity advisories for Vitis, preventing arbitrary code execution. Both fixed over 80 vulnerabilities this Patch Tuesday.

Microsoft SharePoint RCE Vulnerability Lets Remote Attackers Execute Code

gbhackers.com · 2 months ago

RCE flaws in MS SharePoint Server via improper input validation (CVE-2026-63520) and an auth bypass (CVE-2026-55040) create dangerous unauthenticated RCE chains for exposed servers.

CVE-2026-53360: KVM SEV-SNP guest-to-host heap OOB and analysis of the upstream fix

blog.himanshuanand.com · 2 months ago

Researchers found a heap out-of-bounds read/write vulnerability in KVM's SEV-SNP Page State Change handler. A malicious guest VM corrupts host kernel memory by exploiting insufficient bounds checks while specifying overly large entry counts. This critical flaw, tracked as CVE-2026-53360, impacts kernels with SNP PSC support since ~v6.10 and requires patching in versions like v7.0.12.

Malicious CCleaner Installer Patches Chrome Security Extension to Deploy Browser Spyware

gbhackers.com · 2 months ago

Fake CCleaner installer compromises Windows systems via malicious executable abusing cscript.exe. It targets Chrome by modifying its extension manifest to inject content/scripts for keylogging and data collection.

New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges

www.bleepingcomputer.com · 2 months ago

Security researcher Nightmare Eclipse released "ShieldBreak," a new zero-day exploit for Microsoft Defender that grants SYSTEM privileges on fully patched Windows 10, 11, and Server systems. This proof-of-concept bypasses the patch applied to CVE-2026-50656, relating to the RoguePlanet vulnerability. Experts confirmed ShieldBreak operates despite Microsoft's latest August 2026 security updates.

Prompt Injections for Defense

www.schneier.com · 2 months ago

Researchers from Tracebit found a defense method called context bombing. This technique places prompt injections near secrets, like cryptographic keys or passwords stored on Amazon Web Services. These prompts force an attacking LLM to violate its inherent guardrails, causing it to shut down instead of executing malicious commands.

Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack

www.securityweek.com · 2 months ago

A supply chain attack compromised LiteLLM after its CI pipeline installed a vulnerable version of Trivy. TeamPCP published malicious versions to PyPI (1.82.7 and 1.82.8), which stole sensitive data like cloud keys and SSH credentials on every Python invocation. This incident impacted over 2,500 organizations, including AWS, Nvidia, and Cisco, affecting 434,000 CI/CD pipelines.

WindRelay Turns Android Phones Into Fake Payment Terminals for Remote Card Fraud

gbhackers.com · 2 months ago

WindRelay malware combines with the SpyNote remote-access trojan to convert Android phones into rogue contactless card readers. Attackers use these tools during social engineering calls, capturing live EMV contactless exchanges from victims' physical cards. This mechanism enables "Ghost Tap" fraud by relaying valid transaction messages remotely, allowing real-time, card-present cash-out.

ERPNext's Document Follow feature exposed unauthorized data

robinroy.xyz · 2 months ago

A researcher identified a vulnerability chain in Frappe's Document Follow feature involving three authorization failures. This flaw allowed attackers to bypass security controls and potentially exfiltrate sensitive ERP data. The issue was patched by the frappe team, labeling it CVE-2026-66000, CVE-2026-66058, and CVE-2026-66059.

Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

thehackernews.com · 2 months ago

QUIRSO reported that groups exploit a patched flaw in Broadcom VMware vCenter. The vulnerability, CVE-2026-59310, is a critical directory-traversal flaw (CVSS 9.8). Malicious actors utilizing network access can leverage this vulnerability to execute arbitrary code.

4 gaps slowing AI in enterprise SOCs

www.csoonline.com · 2 months ago

SOCs face AI adoption hurdles needing explainable AI for trust over opaque methods. Automate routine tasks to augment analysts gradually, retaining human control for faster investigation.

Fresh Windows Zero-Day Exploited in North Korean Cyberattacks

www.securityweek.com · 2 months ago

Lazarus Group hit the defense sector via fake jobs, exploiting Windows zero-days: CVE-2026-68820 and CVE-2025-49113 (RCE). They deployed ForestTiger/Mistpen malware. Hackers tricked victims into downloading malicious payloads.

The Best Network Traffic Analysis (NTA) Tools, Compared and Priced (2026)

gbhackers.com · 2 months ago

NTA tool pricing varies: some use published costs (Auvik, SolarWinds), others require quotes (Darktrace, Corelight). Buyers must know if pricing is per device (SaaS), flow volume, or bandwidth when budgeting for network observability.

The AI harness is the new attack surface

www.csoonline.com · 2 months ago

AI agent risks stem from surrounding code, not model weights. Researchers found credential-stealing malware in AI skills. Simple plumbing changes boosted attack success from 1% to 24%. Treat the execution layer as a distinct vulnerability point for organizations.

Microsoft Outlook RCE Vulnerability Lets Attackers Execute Code Remotely

gbhackers.com · 2 months ago

Microsoft disclosed a new Remote Code Execution vulnerability in Outlook, cataloged as CVE-2026-70329. This flaw carries a CVSS 3.1 score of 8.8 and stems from an Integer Overflow weakness. Successful exploitation allows attackers to execute arbitrary code, potentially installing malware or exfiltrating data, although user interaction remains necessary for the attack.

Ivanti EPM Update Patches Remotely Exploitable Flaws

www.securityweek.com · 2 months ago

Ivanti issued patches for Endpoint Manager and Neurons for MDM to address multiple flaws. The update resolves CVE-2026-18129, which risks leaking SQL credentials via a man-in-the-middle attack. It also fixes the high-severity CVE-2026-18127 vulnerability that permits remote write control over S3 buckets and addresses the out-of-bounds read flaw (CVE-2026-18125) that can crash EPM agents.

Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations

thehackernews.com · 2 months ago

Two malicious LiteLLM releases appeared on PyPI in March, carrying code designed to steal credentials from installed systems. The malware harvested various secrets, including cloud keys, SSH keys, Kubernetes tokens, and database passwords. Threat intelligence firm CloudSEK now uses a dataset of roughly 434,000 captured files to map the potential exposure risk.

ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact

www.securityweek.com · 2 months ago

Siemens, Schneider Electric, and Phoenix Contact released advisories detailing vulnerabilities across their ICS products. Patches address flaws from remote code execution in Simatic IoT2050 devices to multiple issues in PLCnext firmware. CISA issued new advisories covering weaknesses found in building management systems from Honeywell and Johnson Controls.

Project CAV3RN Uses Google Apps Script and DNS to Hide C2 Traffic in Israeli Cyberespionage Attacks

gbhackers.com · 2 months ago

CAV3RN spyware upgraded C2 to blend HTTPS/Google Apps Script relays. It uses DNS A records for polling and can steer traffic per request, ensuring recovery via.specialized.p subdomains.

Windows AFD.sys Zero-Day Exploited by Lazarus Hackers to Gain SYSTEM Access

gbhackers.com · 2 months ago

Lazarus expanded Operation Dream Job via CVE-2026-68820 (local privilege escalation) targeting global defense/aerospace firms. They use MISTPEN or fake PDFs pre-exploiting race conditions in AFD.sys for SYSTEM access.

SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code

thehackernews.com · 2 months ago

SAP released patches addressing a maximum-severity security flaw in Commerce Cloud's Data Hub Adapter. The vulnerability, CVE-2026-58231, allows arbitrary code execution and scored 10.0 on the CVSS system. Attackers could exploit this issue due to insufficient authorization checks and input validation.

SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform

www.securityweek.com · 2 months ago

SonicWall patched 8 flaws in GMS & Email Security. Critical fixes include CVE-2026-66147/CVE-2026-66145 (unauthenticated RCE/data disclosure) for GMS v9.5.1-. High severity fixes like CVE-2026-66149/CVE-2026-66150 prevent root command execution in Email Security. Updates are available now.

17 old software bugs that took way too long to squash

www.csoonline.com · 2 months ago

Software bugs can remain hidden for decades, complicating modern computing security efforts. Researchers found a Libpng heap buffer overflow vulnerability, cataloged as CVE-2026-25646, that risks information disclosure when processing malicious PNG images. The article also detailed PrintDemon, an older flaw affecting Windows printer drivers in the OS environment.

ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access

thehackernews.com · 2 months ago

Security researcher Chaotic Eclipse released a proof-of-concept (PoC) for ShieldBreak, a zero-day vulnerability targeting Microsoft Defender for Windows. The flaw demonstrates how attackers can bypass patches related to CVE-2026-50656, also called RoguePlanet. This vulnerability registers a CVSS score of 7.8.

US, South Korea Warn of Growing Gunra Ransomware Threat

www.techrepublic.com · 2 months ago

U.S. and South Korean authorities warn about Gunra ransomware's expansion across critical infrastructure. This operation developed into a Ransomware-as-a-Service model, allowing affiliates to target numerous victims using shared malware and infrastructure. Researchers report the group targets both Windows and Linux systems and utilizes double-extortion tactics during attacks.

Fake Corporate VPN Test Creates Scheduled Task and Downloads Malware on Windows

gbhackers.com · 2 months ago

UAC-0145 (Sandworm/APT44) targets IT pros via job sites with social engineering. Fake VPNs use custom WireGuard configs; malware runs PowerShell to create Windows scheduled tasks.

Zoom Zero-Click RCE: AI Helped Build an Exploit in Under 24 Hours

www.techrepublic.com · 2 months ago

A Security revealed "ZOOMSDAY," a zero-click RCE exploit for Zoom clients (Win, Mac, iOS, Android). It targets memory corruption in the annotation feature. Attackers can compromise devices without user interaction; A Security built this using public AI models in under 24 hours.

Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS

thehackernews.com · 2 months ago

Cisco warns that an unauthenticated vulnerability impacts Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. The high-severity flaw, tracked as CVE-2026-20349 (CVSS 8.6), stems from insufficient error checking when processing HTTP requests. This weakness allows remote attackers to trigger code execution in the wild.

Microsoft Patch Tuesday Update August 2026 Fixes Actively Exploited Windows Zero-Day

gbhackers.com · 2 months ago

Microsoft’s August 2026 Patch Tuesday released fixes for hundreds of vulnerabilities across various products, including Windows, Office, SharePoint, Azure.NET, PowerShell, Visual Studio Code, and other enterprise solutions. A total of 394 distinct flaws were documented in this release. Among these vulnerabilities, three zero-day issues are particularly noteworthy.

DEF CON Attendees Allegedly Jam Plane Wi‑Fi, Launch ‘Evil Twin’ Phishing Attack

gbhackers.com · 2 months ago

A Delta Air Lines flight returning travelers from Las Vegas reportedly became the site of a high-altitude Wi-Fi phishing incident when someone on board allegedly disrupted the aircraft’s official internet service and broadcast a fraudulent wireless network.

Cisco Patches Firewall Zero-Day Exploited for DoS Attacks

www.securityweek.com · 2 months ago

CVE-2026-20349 can be exploited remotely without authentication against Secure Firewall ASA and FTD devices.

Zoom Zero-Click ‘Zoomsday’ Flaw Lets Meeting Participants Execute Code on Other Users’ Devices

gbhackers.com · 2 months ago

Zoom has released security updates to address four vulnerabilities that could expose meeting participants to significant attacks, including a zero-click remote code execution flaw dubbed “Zoomsday.” The most severe issue, tracked as CVE-2026-53413, affects Zoom’s annotation feature, which allows participants to draw, highlight, and add text during screen sharing sessions.

One ClickFix Lure Can Give Hackers a Persistent Remote Shell Through New CNCMachineRMS RAT

gbhackers.com · 2 months ago

A ClickFix prompt can end in a remote-access foothold. CNCMachineRMS, an undocumented x64 RAT deployed at the end of a BabaDeda loader chain that turns a user-driven execution event into persistent hands-on-keyboard access. Rather than behaving like a conventional commodity stealer, the 1.

Docker CopyEscape Vulnerability Enables Host File Overwrite and Root Code Execution

gbhackers.com · 2 months ago

A critical vulnerability in Docker, tracked as CVE-2026-17106 and referred to as “CopyEscape,” allows malicious containers to overwrite files on the host system using the widely utilized docker cp command.

Metabase SQLi exploit grants attackers total access

www.csoonline.com · 2 months ago

Business intelligence (BI) platform provider Metabase has disclosed a zero-day SQL Injection vulnerability, warning that customers’ sensitive credentials, tokens, API keys, and other data may have been exposed. The Metabase vulnerability revealed on August 6, designated CVE-2026-72898, is identified as critical, with a severity score of 10, the highest possible rating. It is present in versions 1.

Google says Chrome cuts 7 billion unwanted Android notifications a day to fight abuse

www.bleepingcomputer.com · 2 months ago

Google says Chrome's anti-abuse systems reduced unwanted notifications on Android by more than 7 billion per day during the first quarter of 2026.

Patch Tuesday August 2026: A zero-day WinSock driver hole under exploit, and a maximum severity SAP vulnerability

www.csoonline.com · 2 months ago

A currently exploited zero-day elevation of privilege vulnerability that needs to be patched in a Windows driver for WinSock is the highlight of the 398 fixes issued today in Microsoft’s August Patch Tuesday releases.

Zoom zero-click RCE flaws allow attackers to compromise meeting participants

www.csoonline.com · 2 months ago

Zoom has fixed four vulnerabilities across its applications, including two that could allow attackers who join a meeting to execute malicious code on the systems of all other meeting participants with no interaction required from them. Three of the vulnerabilities affect all Zoom client applications for all platforms before versions 7.1.5 and 7.0.

DeadLock ransomware uses blockchain to resist infrastructure takedown

www.bleepingcomputer.com · 2 months ago

The DeadLock ransomware operation is using a decentralized infrastructure that relies on blockchain-backed services to protect its communication with victims and data-leak activity.

Microsoft's Patch Tuesday Deluge Continues With August Updates

www.darkreading.com · 2 months ago

Security experts say prioritization should be the main focus for the August updates, not the massive CVE volume.

Microsoft Plugs Nearly 400 Security Holes

krebsonsecurity.com · 2 months ago

Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today.

Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA

www.darkreading.com · 2 months ago

The ransomware-as-a-service operation is finding success against critical infrastructure targets with leaked Conti code and old flaws in firewalls and VPN appliances.

Sandworm hackers target IT pros with trojanized WireGuard VPN client

www.bleepingcomputer.com · 2 months ago

Hackers associated with the Russian threat group Sandworm have been targeting system administrators and IT professionals through fake job offers since at least May.

Expired DMARC reporting endpoint exposed a NYSE Fortune 1000's infrastructure for $10

www.sh.consulting · 2 months ago

I registered an expired DMARC reporting domain (gca-emailauth[.]org) for $10. It had been published as the aggregate-reporting address in Global Cyber Alliance DMARC training docs going back to a 2019 bootcamp, and at some point it lapsed. Shortly after registration, aggregate DMARC reports for 86 domains across 20+ organizations started arriving.

Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack

thehackernews.com · 2 months ago

Microsoft released its monthly security updates on Tuesday, and one of the flaws it closed is already being used in attacks. The bug sits in a core Windows kernel driver that handles network socket operations. An attacker with code already running on a machine can use it to escalate to SYSTEM. That patch goes out first. The flaw is tracked as CVE-2026-68820 (CVSS score: 7.

Cisco warns of ASA and FTD VPN flaw exploited to crash devices

www.bleepingcomputer.com · 2 months ago

Cisco is warning that a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense (FTD) software is being actively exploited in attacks to remotely crash affected devices.

Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing

thehackernews.com · 2 months ago

Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things (IoT) botnet that comes with significant improvements to improve its operational resilience and conduct distributed denial-of-service (DDoS) attacks. The new version, tracked as Kimwolf v7, was discovered by Palo Alto Networks Unit 42 in February 2026.

Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client

thehackernews.com · 2 months ago

Anyone sharing their screen on a Zoom call could have taken over the computers of everyone watching, and anyone watching could have taken over the presenter's. The flaw sat in the annotation tool, the feature that lets participants draw and type on a shared screen, and it asked nothing of the victim beyond being in the meeting.

Spotify Will Label A.I. Artists and Avoid Recommending Them

www.nytimes.com · 2 months ago

The new label, which will begin to be applied next month, is an effort by the streaming service to be more transparent about A.I.-generated music on its app.