Blahalla

ErrTraffic Combines WordPress Hacks, Blockchain C2 and Rotating Malware Domains in One Delivery Network

gbhackers.com · 2 months ago

An active ErrTraffic malware-as-a-service campaign that combines compromised WordPress sites, ClickFix lures, Polygon blockchain smart contracts and rapidly rotating payload domains to distribute a broad set of Windows malware. ErrTraffic is marketed as a MaaS framework by a forum user known as “LenAI.

GhostJacking Attacks Let Hackers Hijack AI Agents and Steal Cloud Credentials

gbhackers.com · 2 months ago

Security researchers have disclosed “GhostJacking,” a new class of attacks that exploits trusted observability and security platforms to manipulate AI agents into making unauthorized infrastructure changes, executing attacker-controlled commands, and exposing cloud credentials.

Kimwolf v7: An Evolution of the Kimwolf Botnet

unit42.paloaltonetworks.com · 2 months ago

Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing.

Hacker Conversations: Marcus Hutchins and the Journey From the Gray Zone to Redemption

www.securityweek.com · 2 months ago

Marcus Hutchins doesn’t personally consider himself a hacker, but he accepts the epithet because it’s a widely used term for what he once did.

CISA Warns SonicWall SMA1000 Flaws Are Exploited in Ransomware Attacks

gbhackers.com · 2 months ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in SonicWall SMA1000 to its Known Exploited Vulnerabilities catalog, noting that the flaw has been used in ransomware campaigns. This vulnerability, tracked as CVE-2026-15409, is a server-side request forgery (SSRF) issue found in the Workplace interface of SonicWall SMA1000 appliances.

US and South Korea warn of Gunra ransomware targeting govt agencies

www.bleepingcomputer.com · 2 months ago

U.S. federal agencies and South Korea's National Policy Agency warned government and critical infrastructure organizations worldwide to secure their systems against Gunra ransomware attacks.

OpenAI Unveils New Cybersecurity Model GPT-5.6-Cyber

www.securityweek.com · 2 months ago

OpenAI has also announced the expansion of its Daybreak platform to give more organizations access to its AI.

Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks

thehackernews.com · 2 months ago

Cybersecurity and intelligence agencies from South Korea and the U.S. warned of Gunra ransomware attacks targeting critical infrastructure sectors and organizations across the world. Targets of these attacks include healthcare and public health, financial services, government services and facilities, and professional and nonprofit services.

How Social Media Sparked a Refugee Crisis Between Spain and Morocco

www.nytimes.com · 2 months ago

A wave of disinformation online contributed to a surge of migrants in the Spanish enclave of Ceuta who were trying to reach Europe, resulting in about 90 deaths.

Security leaders’ rogue AI confidence could actually be disastrous

www.csoonline.com · 2 months ago

A large majority of IT and security leaders are confident in their teams’ ability to detect when an AI agent has gone rogue, but few are able to take quick action to mitigate the fallout when an agent exceeds its intended scope.

Hackers Pivot Through Private APN to Sabotage Siemens PLCs at Polish Power Plant

gbhackers.com · 2 months ago

Threat actors used a private cellular access-point-name (APN) network to pivot from a compromised wind farm into the operational technology environment. A Polish combined heat and power plant, where they disrupted Siemens programmable logic controllers and briefly interrupted cogeneration operations.

CiscoClamAV Vulnerabilities Let Remote Attackers Crash Antivirus Scanning With Crafted Files

gbhackers.com · 2 months ago

Cisco has disclosed seven high-severity vulnerabilities in ClamAV that could allow unauthenticated remote attackers to disrupt antivirus scanning by submitting specially crafted files. These vulnerabilities are tracked as CVE-2026-20337, CVE-2026-20338, CVE-2026-20339, CVE-2026-20345, CVE-2026-20346, CVE-2026-20347, and CVE-2026-20348, and have been assigned a maximum CVSS score of 7.5.

Anthropic Adds Invisible Watermarks to Claude AI-Generated Text and Signed Metadata to Files

gbhackers.com · 2 months ago

Anthropic has launched a machine-readable content-marking initiative for materials generated by its Claude models. This initiative combines invisible text watermarks with digitally signed provenance metadata for supported files. This move follows Anthropic’s commitment to the transparency guidelines outlined in Article 50(2) of the European Union AI Act.

OpenAI Launches GPT-5.6-Cyber to Find Zero-Day Vulnerabilities and Develop Exploit Chains

gbhackers.com · 2 months ago

OpenAI has expanded its Daybreak cybersecurity program with the introduction of GPT-5.6-Cyber, a purpose-trained model specifically designed for authorized vulnerability research, exploit validation, and advanced security testing. Built on the foundation of GPT-5.6 Sol, this new model serves as a controlled-access tool for trusted defenders as AI-assisted offensive capabilities continue to evolve.

Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine

thehackernews.com · 2 months ago

Attackers shut down a steam turbine and the process-water treatment system at a Polish combined heat and power plant by coming in over the private cellular network the local grid operator uses to reach remote equipment. The plant supplies heat to roughly 50,000 residents. Recovery began at about 7:30 a.m.

DeadLock Ransomware Disables Windows Defender, Backups and Event Logs Before Encrypting Files

gbhackers.com · 2 months ago

DeadLock, an emerging financially motivated ransomware operation that couples conventional intrusion tradecraft with decentralized infrastructure engineered to survive disruption. First observed in July 2025, the operation uses double extortion: encrypting enterprise data while threatening publication of stolen material.

Pass-the-Passkey Attack Exploits Windows and Entra ID to Bypass MFA

gbhackers.com · 2 months ago

Security researchers have recently revealed a new attack family named “Pass-the-Passkey,” which enables adversaries to impersonate enterprise users and circumvent phishing-resistant multi-factor authentication (MFA) protections in Windows 11 and Microsoft Entra ID environments. This research challenges the belief that passkeys are inherently immune to credential replay and session abuse.

Mozilla Issues New Firefox GPG Key Following Exposure

www.securityweek.com · 2 months ago

The previous GPG signing subkey was inadvertently added to a GitHub repository and Mozilla decided to revoke it.

BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins

thehackernews.com · 2 months ago

Cybersecurity researchers have warned of a supply chain compromise impacting WordPress plugin vendor BdThemes, prompting the content management systems (CMS) platform's plugins team to temporarily disable their downloads. "Unlike traditional software supply chain attacks, zero source code files were modified within the official WordPress.org repository," Wordfence researcher Paolo Tresso said.

New Abyssos RAT Hijacks Browser Sessions, Steals Credentials and Gives Attackers Remote VNC Access

gbhackers.com · 2 months ago

Abyssos, a modular C++ remote-access trojan that combines credential theft, browser-session hijacking, file exfiltration and hidden VNC control in a single post-compromise framework. Technical analysis from ThreatLabz indicates that Abyssos is designed for hands-on intrusion activity rather than opportunistic, single-purpose theft. The most concerning feature is its hidden VNC capability.

Red Hat Kubernetes Flaw Allows Attackers to Escalate Privileges to Cluster-Admin

gbhackers.com · 2 months ago

Red Hat has disclosed a privilege-escalation vulnerability in Red Hat Advanced Cluster Management for Kubernetes (ACM) that could allow a low-privileged user to gain full cluster-admin control of an affected hub cluster. This vulnerability is tracked as CVE-2026-10090 and affects the Application Subscription controller, specifically the multicluster-operators-subscription. It has a CVSS v3.

Claude Code Auto Mode Blocks 89% of Dangerous Commands and Prompt Injection Attacks

gbhackers.com · 2 months ago

Anthropic will make Auto Mode the default setting in Claude Code for Pro, Max, and Team subscribers starting August 14, 2026. This change introduces an automated classifier to replace repetitive manual permission approvals during long-running development tasks.

CISA Urges Organizations to Patch Exposed VPNs and Segment Networks Against Gunra Ransomware

gbhackers.com · 2 months ago

CISA and international law-enforcement partners have issued a joint StopRansomware advisory warning that Gunra ransomware affiliates are exploiting exposed edge infrastructure, including VPN gateways, firewall appliances and RDP-accessible systems, to breach enterprise networks.

Mark Zuckerberg’s latest manifesto promises to save America with AI

www.washingtonpost.com · 2 months ago

The Meta CEO's 6,500 word open letter echoes his previous arguments that letting his company innovate without restrictions will spread American values worldwide.

The future of AI security research isn’t autonomous, it’s human-amplified

www.csoonline.com · 2 months ago

Meet HTTP Terminator, a new AI system that has identified hundreds of websites vulnerable to HTTP request smuggling, hacked them live at scale, and even identified a “genuinely new class” of vulnerability, dubbed “shared-parser confusion.” But it didn’t do it alone; it was guided by a human the entire time, which may be the most interesting finding of all.

Wall St. Wants Another Half-Trillion Dollars for the A.I. Boom

www.nytimes.com · 2 months ago

Six giant investment firms announced a $500 billion effort to raise money for customers of Nvidia to pay for computing power.

Hackers breached a small Polish energy plant via private APN last year

www.bleepingcomputer.com · 2 months ago

Hackers breached a heat-and-power plant facility in Poland, which supplies heat to about 50,000 residents, using a private APN (Access Point Name) to access an OT (Operational Technology) network.

The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications

unit42.paloaltonetworks.com · 2 months ago

Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution.

'GhostJacking' Exposes Identity Governance Gaps in AI Agents

www.darkreading.com · 2 months ago

New research shows how attackers can use security alerts and blocked events to manipulate and hijack AI agents.

Multistate Water System Attacks Widen, Iran Suspected

www.darkreading.com · 2 months ago

Attacks targeting water systems just keep flowing across a dozen states, against ill-secured, Internet-exposed PLCs.

BdThemes plugins supply-chain hack creates rogue WordPress admins

www.bleepingcomputer.com · 2 months ago

A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators' browsers to create rogue admin accounts.

Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius

www.darkreading.com · 2 months ago

The maximum-severity vulnerability, which still has no CVE, allows malicious, remote administrator access to the business-analytics platform and its downstream users.

OpenAI releases ChatGPT 5.6 Cyber, but it's only for approved users

www.bleepingcomputer.com · 2 months ago

OpenAI has developed a new model called "GPT 5.6 Cyber," designed for vulnerability research, penetration testing, incident response, and remediation.

Inside a Russian-speaking operator's toolkit for compromising Ukrainian IP cameras

hunt.io · 2 months ago

Hunt.io researchers analyzed two open directories recovered through our Attack Capture system and reconstructed the tooling one operator used to find, exploit, and view internet-exposed cameras in Ukraine.

Updated GPG key for signing Firefox and Thunderbird Releases

blog.mozilla.org · 2 months ago

Today, we moved to a new GPG signing subkey used to sign certain Firefox and Thunderbird artifacts (namely Linux tarballs, RPM packages, checksums files) after an unencrypted copy of the … Read more

The Patch Gap: Why Defenders Need to Think in Chains, Not Checklists

www.darkreading.com · 2 months ago

It's time to turn from CVSS-backed patching to choke-point patching focused on breaking chains to critical assets.

New StormEncryptor ransomware used by former Medusa affiliate

www.bleepingcomputer.com · 2 months ago

A financially motivated threat actor previously associated with the Medusa ransomware operation is now deploying a new ransomware strain called StormEncryptor.

Klaviyo Sign-Up Bug May Have Exposed Passwords to Ad Trackers

www.techrepublic.com · 2 months ago

Klaviyo says fewer than 200 people are known to be affected by a sign-up bug that may have exposed passwords to third-party trackers.

Coruna, DarkSword iOS Exploits Proliferate Globally

www.darkreading.com · 2 months ago

Sophisticated iPhone exploit chains previously limited to nation-states are spreading far and wide to organized cybercrime groups.

China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw

thehackernews.com · 2 months ago

Microsoft has disclosed that Storm-1175, a financially motivated threat actor linked to China, has deployed a previously undocumented ransomware strain called StormEncryptor. The use of StormEncryptor marks a shift from the adversary's previous use of Medusa ransomware, the Microsoft Threat Intelligence Team said. "StormEncryptor is written in C++ and appends the file name extension.

Outdated Cybercrime Laws Put Security Researchers at Risk

www.darkreading.com · 2 months ago

A public policy expert mapped global cybercrime laws to develop a five-point framework for protecting ethical hackers and good-faith security research.

Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise

www.microsoft.com · 2 months ago

Microsoft is named a Leader in the 2026 IDC MarketScape for MDR services. Discover how Microsoft Defender Experts MDR combines AI, threat intelligence, and human expertise.

Sherlock Holmes was the “OG” Social Engineer

www.darkreading.com · 2 months ago

The crime solver wore disguises, spied on targets, and built intelligence networks long before modern-day tactics emerged. He has lessons for today’s ethical- and nonethical-hat hackers.

Lawmakers ramp up pressure on AI companies over rogue models

www.washingtonpost.com · 2 months ago

Recent disclosures about misbehavior by artificial intelligence models, including hacking into external systems, have spurred growing concern.

⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors

thehackernews.com · 2 months ago

A lot of security problems still begin with someone doing a completely normal thing. Cloning a repo. Answering a call. Leaving a box exposed. Trusting the default. That pretty much covers the mood this week. Old bugs are back, supply chains are getting stranger, and some exploit paths are so short you wonder what was supposed to stop them in the first place. That’s only part of it.

DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

www.microsoft.com · 2 months ago

Microsoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications, negotiations, and data leak operations alongside double extortion tactics used to pressure victims.

77 Counterfeit Open VSX Extensions Collected Developer and CI/CD Data

www.techrepublic.com · 2 months ago

Security researchers found 150 lookalike Open VSX extensions published under trusted names, highlighting how extension marketplaces can expose developer credentials, source code, and CI/CD systems to supply-chain risk.

CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

www.bleepingcomputer.com · 2 months ago

CISA has confirmed that ransomware gangs have begun exploiting two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery (SSRF) flaw.

OpenAI’s Upcoming Astra Model Raises Autonomous Cyberattack Concerns

www.securityweek.com · 2 months ago

The current GPT-5.6-Sol has been assigned a ‘high’ cybersecurity threshold, but Astra could reach the maximum ‘critical’ threshold.

Fake The Odyssey Downloads Are Hiding Password-Stealing Malware

www.techrepublic.com · 2 months ago

Fake downloads of The Odyssey are spreading Lumma Stealer malware capable of stealing passwords, cookies, payment data, and cryptocurrency information.