Blahalla

PoC Exploit Released for Android Zero-Click Flaw Enabling Remote Shell Access

gbhackers.com · 2 months ago

A public proof of concept is circulating for CVE-2026-0073, a critical no-interaction remote code execution flaw in Android's adbd that can grant shell access when wireless ADB is reachable on a network. The weakness stems from a logic error in adbdtlsverifycert that can cause a crafted TLS client certificate to be treated as trusted, bypassing mutual authentication and allowing an unauthorized ADB host to open a shell session. Defenders are urged to apply the May 2026 Android security update, disable wireless debugging where not needed, and treat any LAN or internet reachable ADB service as a sensitive attack surface because public exploit references increase the likelihood of opportunistic scanning and targeted abuse.
TrickMo Android banker adopts TON blockchain for covert comms

www.bleepingcomputer.com · 2 months ago

A new variant of the TrickMo Android banking malware is being delivered in campaigns across Europe and targets banking credentials and cryptocurrency wallets in France, Italy, and Austria. It uses The Open Network TON overlay for covert command and control by resolving operator endpoints as.adnl identities through an embedded local TON proxy on infected devices, which hides IP addresses and makes traditional domain takedowns and network edge detection ineffective. The malware retains a modular two stage design and adds network diagnostic and proxying commands including curl, dnsLookup, ping, telnet, traceroute, SSH tunneling, remote and local port forwarding, and authenticated SOCKS5 proxy support while continuing to perform phishing overlays, keylogging, screen recording, SMS interception, one time password suppression, clipboard modification, notification filtering, and screenshot capture.
8 guiding principles for reskilling the SOC for agentic AI

www.csoonline.com · 2 months ago

There are eight guiding principles for reskilling security operations for agentic AI, including embracing the agentic imperative, setting the tone from the top, respecting resistance while overcoming it, and providing hands-on, sandboxed training. Security leaders report embedding vendor experts, running bootcamps and internal sandboxes such as LabX to encourage rapid experimentation while redeploying humans into higher-value oversight and automation design roles. Organizations are urged to emphasize governance and human-in-the-loop controls with escalation paths, audit trails and override authorities, to rethink operating models and career ladders as L1 and L2 functions become agentic, and to train analysts in model intuition and policy setting so agents operate within defined decision boundaries.
See the hidden rules behind AI. Then use them to rewrite this article.

www.washingtonpost.com · 2 months ago

There are thousands of words of hidden instructions called system prompts that companies inject into every chatbot conversation to steer personality, policy compliance, and tool use, and those instructions can take priority over what a user types. Researchers who extracted system prompts found they range from a few hundred to more than twenty thousand words and include specific rules such as forbidding unnecessary discussion of goblins and strict limits on quoting copyrighted material. Companies generally keep full system prompts secret and offer only limited personalization features that let users request tone or formatting changes but not directly edit the underlying instructions.
1,800+ MCP servers exposed without authentication: How zero trust can secure the AI agent revolution

www.csoonline.com · 2 months ago

There are widespread exposures of Model Context Protocol servers, with 1,862 publicly reachable instances identified and a verified sample of 119 that all permitted unauthenticated access to internal tool listings. Exposed servers include production systems with write access to financial databases, social media accounts, and customer relationship management platforms, creating opportunities for tool poisoning, rug pulls, and cross-server contamination that enable stealthy data exfiltration. Researchers have documented high-impact vulnerabilities, including EchoLeak CVE-2025-32711, a zero-click technique that hides malicious instructions in documents to coerce Microsoft 365 Copilot into exfiltrating data, and mcp-remote CVE-2025-6514, a JFrog package command injection via unsanitized OAuth parameters that can yield full system compromise. Security recommendations include adopting the Agentic Trust Framework and zero-trust controls such as identity governance for agents, mandatory authentication and authorization for every interaction, cryptographic signing and immutable versioning of tool definitions, network segmentation, continuous behavioral monitoring, and human-in-the-loop approval for sensitive operations.
Canvas System Is Online After a Cyberattack Disrupted Thousands of Schools

www.securityweek.com · 2 months ago

On May 11, 2026, tens of thousands of students regained access to the Canvas online learning system after a cyberattack had knocked the platform offline during finals, forcing schools to reschedule exams and seek workarounds. Instructure reported that an unauthorized actor made changes to pages visible to logged in users and that the attacker exploited an issue related to Free For Teacher accounts, which the company temporarily disabled while investigating. A hacking collective claiming to be ShinyHunters said nearly nine thousand schools were affected and that billions of private messages and records were accessed, and Instructure has not confirmed whether a ransom was paid or which data was compromised.
OpenClaw Malware Targets Crypto Wallets and Bitwarden Credentials

gbhackers.com · 2 months ago

OpenClaw users are being targeted by a malware campaign that distributes a fake OpenClaw Windows installer containing a 130 megabyte Rust executable named Hologram padded with fake documentation to evade antivirus and sandbox file size limits. After multi layer anti virtual machine checks that can wait for real mouse movement, the dropper decodes and runs an obfuscated PowerShell payload that disables Microsoft Defender, opens inbound firewall ports, retrieves a password protected archive and drops multiple Rust based modules that establish resilient persistence and Telegram based callbacks via a Hookdeck relay. The stage two Stealth Packer framework includes six Rust components that execute payloads entirely in memory using techniques such as hosting the.NET CLR inside Rust and reflectively executing decrypted PE files via direct NT syscalls, and it uses a server side manifest to target 250 browser extensions including 201 crypto wallet extensions such as MetaMask, Phantom, Coinbase and OKX, plus 49 password managers including Bitwarden, LastPass and 1Password. Operators also deploy a separate Ledger Live module to steal funds and rely on legitimate cloud services including Azure DevOps, Telegram and Hookdeck for command and control, making detection difficult and requiring defenders to inspect application layer traffic rather than rely on IP only perimeter controls.
MyAudi app:Security issues in Audi Connected Vehicle experience

decoder.cloud · 2 months ago

A security researcher found that the myAudi connected vehicle platform allows anyone who knows a vehicle identification number to add that vehicle as a guest user and access sensitive vehicle and ownership information. Some GraphQL endpoints had introspection enabled exposing API schemas, and vehicle management endpoints returned embedded SIM identifiers such as IMEI and ICCID along with license and service metadata. Guest users could poll and retrieve pending requests initiated by primary users, including honk and flash responses that contained the requesting user's GPS location and unlock status; that specific issue has been fixed following disclosure while other findings remain under evaluation and a full review of vehicle association logic was recommended.
New ‘Dirty Frag’ Linux Vulnerability Possibly Exploited in Attacks

www.securityweek.com · 2 months ago

A newly disclosed local privilege escalation vulnerability affecting major Linux distributions, called Dirty Frag and Copy Fail 2 and tracked as CVE-2026-43284 and CVE-2026-43500, can allow an unprivileged user to escalate permissions to root. The exploit chains two kernel flaws affecting the xfrm-ESP and RxRPC components, was publicly disclosed before patches were available, and technical details and proof of concept code were made available online. Microsoft and other vendors report limited in the wild activity that may indicate exploitation, including post compromise modification of authentication and PHP session files. Linux distributors including Red Hat, Amazon Linux, Ubuntu, Fedora and AlmaLinux have released patches and mitigations and organizations are advised to apply updates.
Giving Claude Code Full Control of a Hardware Fault Injection Setup to Bypass Secure Boot

raelize.com · 2 months ago

Researchers used an autonomous Claude Code agent to reproduce a fault injection attack that bypassed Secure Boot V1 on an Espressif ESP32 system on chip using voltage crowbar glitches. The AI wrote all of the software tooling and orchestrated hardware including a ChipWhisperer Husky, an RK6006 power supply, a PicoScope, and an ESP-PROG adapter, reverse-engineered and emulated the rev-0 boot ROM, ran thousands of glitch attempts, and built a live monitoring dashboard while the campaign ran. The issue is specific to ESP32 Secure Boot V1 and was mitigated in ESP32 V3 by modifying ROM code, though related fault injection risks remain.
Crimenetwork Bust Reveals 22,000 Members and Over 100 Illicit Vendors

gbhackers.com · 2 months ago

Law enforcement dismantled the relaunched Crimenetwork online marketplace after arresting a 35 year old German national at his residence in Mallorca, Spain on a European Arrest Warrant. Investigators seized about 194,000 euros in physical and digital assets, recovered user databases and transaction logs, and found the site had grown to more than 22,000 registered users and over 100 active vendors trading stolen data, narcotics and forged identification. The marketplace used Bitcoin, Litecoin and Monero to process payments and generated more than 3.6 million euros in revenue while charging commissions and recurring vendor fees. The operation was a coordinated effort between German, Spanish, Moldovan and European agencies and follows a March 2026 conviction that resulted in a seven year ten month prison sentence and the confiscation of over ten million euros for the previous operator.
Resurrected ‘Crimenetwork’ Marketplace Taken Down, Administrator Arrested

www.securityweek.com · 2 months ago

German police shut down the second iteration of the German speaking Crimenetwork marketplace and arrested a 35 year old man suspected to be its administrator. The resurrected marketplace had grown to more than 22,000 users and over 100 sellers and facilitated trade in stolen information, drugs, and falsified documents using cryptocurrencies such as Bitcoin, Litecoin, and Monero. Investigators say the platform generated more than 3.6 million euros in revenue and law enforcement seized about 194,000 euros along with extensive user and transaction data for further analysis. The original Crimenetwork had been taken down in December 2024 after more than a decade of operation and investigators estimated that over 100 million dollars in cryptocurrency passed through it between 2018 and 2024.
ShinyHunters Exploits Canvas LMS Free Teacher Accounts in New Breach

gbhackers.com · 2 months ago

ShinyHunters exploited Canvas LMS Free‑For‑Teacher accounts in early May 2026 to access production tenant data across thousands of schools worldwide. The exposure window ran from April 30 to May 7 2026, the group claimed responsibility on May 3 and posted a ransom note threatening to leak data while claiming to hold 3.6 terabytes of data covering roughly 275 million users across about 9,000 schools. Instructure took Canvas services offline, permanently shut down the FFT program, rotated privileged API keys and is working with forensic investigators and law enforcement while stating it has found no evidence so far that passwords, dates of birth, government identifiers, or financial information were accessed, though names, email addresses, student ID numbers and some private messages were exfiltrated, increasing the risk of targeted phishing.
Fake OpenAI Privacy Filter Repo Hits #1 on Hugging Face, Draws 244K Downloads

thehackernews.com · 2 months ago

A malicious Hugging Face repository impersonated OpenAI's Privacy Filter open-weight model, copied the legitimate model card, and briefly reached the platform's top trending position with roughly 244,000 downloads before being disabled. The project provided Windows and cross-platform loaders that disabled SSL verification, used a public JSON paste service to retrieve commands, invoked PowerShell to download a second-stage downloader that elevated privileges and configured antivirus exclusions, and ultimately delivered a Rust-based information stealer that harvested screenshots, messaging data, cryptocurrency wallet information, FileZilla configurations, and browser data for exfiltration. Researchers identified multiple other repositories using the same Python loader and tied the shared infrastructure and payload behavior to broader supply chain operations and prior campaigns that deployed a modular remote access trojan attributed to the Silver Fox threat actor.
Windows CreateFileW API Flaw Could Let Attackers Lock SMB Files at Scale

gbhackers.com · 2 months ago

A newly disclosed technique called GhostLock abuses the Windows CreateFileW API to acquire exclusive deny share handles and lock large numbers of SMB files across enterprise network shares without writing or encrypting any data. A proof of concept shows a low privileged domain user can lock up to half a million files in under three minutes, triggering widespread sharing violations that disrupt enterprise resource planning systems and shared workflows while leaving no traditional forensic traces. Detection and response require ingesting storage session telemetry to alert on unusually high numbers of exclusive handles per session and coordinating with storage administrators to forcibly terminate the offending network session because revoking credentials alone will not release the locks.
Weaponized JPEG file Drops Trojanized ScreenConnect Malware

gbhackers.com · 2 months ago

Hackers are abusing a weaponized JPEG named sysupdate.jpeg that contains an obfuscated PowerShell script which, when executed, stages components from attacker infrastructure to install a trojanized ConnectWise ScreenConnect client and establish persistent remote access for surveillance and credential theft. The PowerShell loader compiles a unique launcher executable on the victim using csc.exe, performs a fileless UAC bypass via ComputerDefaults.exe and a crafted ms-settings protocol handler, and installs a malicious Windows service named OneDriveServers that deploys a modified ScreenConnect client connecting to legitserver.theworkpc.com and the hard coded IP 45.138.16.64. The trojanized ScreenConnect instance exposes dozens of operator capabilities including live screen viewing, continuous recording, microphone capture, clipboard and print interception, credential provider hooking to capture login credentials, account lifecycle control, and encrypted command and control using PBKDF2 HMAC SHA256 derived keys. Organizations are advised to block PowerShell execution from untrusted sources, harden UAC and registry policies, monitor ScreenConnect installations and unexpected services such as OneDriveServers, and inspect JPEG files for embedded non image content.
macOS Malware Abuses Google Ads and Claude Shared Chats to Deliver Payloads

gbhackers.com · 2 months ago

There is a sophisticated malvertising campaign targeting macOS users that leverages malicious Google Ads and legitimately shared Anthropic Claude chats to trick developers into executing an obfuscated installation command that delivers a MacSync malware variant. The installation command conceals the payload URL in base64 and pipes the downloaded content into the macOS zsh for immediate execution, with delivery and command and control infrastructure hosted on attacker controlled domains. The payload is identified as a MacSync variant with SHA-256 hash bbd98170ea66c8d13605cb88ad0e18602ef40c0745f7b2c979a8a342a31c1857. Recommended mitigations include enforcing policies against pasting terminal commands from untrusted sources, verifying downloads via official vendor sites, monitoring for anomalous zsh executions, and blocking known malicious command and control domains.
ODINI Malware Uses CPU Magnetic Signals to Exfiltrate Data from Air-Gapped Systems

gbhackers.com · 2 months ago

ODINI is malware that exfiltrates data from air-gapped systems by modulating low-frequency magnetic fields generated through deliberate CPU power consumption, demonstrating that Faraday cages and isolation can be bypassed. It encodes data by rapidly loading and unloading processor cores, transmits at speeds up to 40 bits per second to magnetic receivers placed up to 150 centimeters away, requires no elevated privileges, can operate from inside virtual machines, and evades traditional antivirus detection. Defenses include strict physical zoning to prevent nearby unauthorized sensors, active magnetic signal jamming, and costly ferromagnetic shielding such as mu-metal, each with practical trade-offs.
What It Costs to Hire a Hacker on the Dark Web in 2026

www.techrepublic.com · 2 months ago

Hacker for hire services on the dark web are widely available and are typically paid for with cryptocurrency, covering attacks from distributed denial of service to data theft, social account takeovers, and changing school grades. Distributed denial of service attacks range from ten dollars to two thousand five hundred dollars, with gaming targets typically fifty to two hundred dollars and high value targets such as financial institutions or government networks reaching up to five thousand dollars, and some providers charge by time for example seven dollars and fifty cents per hour thirty five dollars per day and two hundred fifty dollars for longer campaigns. Personal attacks range from ten dollars to over six hundred dollars, access to personal information averages six hundred dollars, a physical US identification card costs about one hundred fifty to one hundred sixty dollars and a European passport is advertised around three thousand eight hundred dollars. Website and database access averages one thousand two hundred dollars with small business compromises as low as six hundred dollars and advanced website crimes costing five thousand to fifty thousand dollars, computer and phone hacking averages nine hundred fifty dollars with phone or email access often five hundred to five thousand dollars and ransomware or large scale extortion typically demanding at least fifty thousand dollars, while social media account takeovers range twenty to five hundred dollars averaging two hundred thirty dollars, email account access averages two hundred forty one dollars and changing grades averages one thousand six hundred dollars.
New cPanel and WHM Vulnerabilities Expose Servers to Code Execution and DoS Attacks

gbhackers.com · 2 months ago

On May 8, 2026, researchers disclosed three severe security flaws affecting cPanel, WebHost Manager and the WP Squared platform that can enable arbitrary code execution, arbitrary file disclosure, and symlink based permission manipulation leading to denial of service and possible local privilege escalation. The flaws are tracked as CVE-2026-29202, a critical Perl code injection in the createuser API via the plugin parameter; CVE-2026-29201, an arbitrary file read in the feature::LOADFEATUREFILE adminbin call; and CVE-2026-29203, unsafe symlink handling that permits chmod on arbitrary files. The vendor released emergency patches and administrators are urged to update to version 11.136.0.9 or higher, apply listed backported fixes for older branches, update WP Squared to 11.136.1.10, and force and verify updates immediately to mitigate exploitation.
JDownloader Hack Spreads New Python RAT

gbhackers.com · 2 months ago

There was a supply chain attack on the official JDownloader website that redirected specific download links to malicious installers containing a heavily obfuscated Python based remote access trojan. Attackers exploited an unpatched content management system vulnerability to redirect the Download Alternative Installer for Windows and the Linux shell installer during a risk window from May 6 through May 7, 2026, and the site was taken offline on May 7 once developers were alerted. The Windows executables were signed with spoofed publisher names and the Linux installer contained injected code that installed a SUID root launcher and disguised the payload to evade detection. Eight malicious Windows installers and one compromised Linux installer were identified, and users who ran the compromised installers are advised to reinstall their operating systems and verify downloads by comparing SHA256 checksums and file sizes against the vendor’s incident report.
Top 10 Best Secure Code Review Services For Developers in 2026

gbhackers.com · 2 months ago

There are ten leading secure code review services for developers in 2026 that emphasize shifting security left by combining automated analysis with expert manual review to identify and remediate vulnerabilities earlier. Key trends include AI powered detection, stronger focus on software supply chain and open source component analysis, cloud native and container awareness, and deep integration of secure code review into CI CD pipelines to provide contextual, actionable remediation for developers. The market spans developer centric platforms offering real time feedback, pentesting as a service for collaborative offensive testing, and enterprise platforms that prioritize accuracy, low false positives, scalability, and compliance reporting.
Top 10 Best DevSecOps Companies For Secure SDLC 2026

gbhackers.com · 2 months ago

There is growing urgency to embed security across the software development life cycle as the DevSecOps market, valued at roughly USD 2.8 billion in 2024, is projected to reach USD 23.1 billion by 2033. Key 2026 trends driving adoption include accelerated release cycles, cloud native and container complexities, software supply chain attacks, AI and machine learning risks, and tighter data privacy regulations, making shift left security and continuous testing essential. A vendor comparison highlights Snyk, Checkmarx, GitLab, Veracode, Aqua, ArmorCode, SonarQube, Fortify, Lacework, and Contrast Security, noting varying coverage of SAST, DAST, SCA, IAST, infrastructure as code scanning, container and API security, and AI assisted features that make some platforms more developer focused and others better suited to large enterprises.
Over 500 Organizations Hit in Years-Long Phishing Campaign

www.securityweek.com · 2 months ago

Operation HookedWing is a years-long phishing campaign that has stolen more than two thousand user credentials across over five hundred organizations in aviation, travel, critical infrastructure, energy, financial, government, logistics, public administration, and technology sectors. The campaign, active since at least 2022, relied on GitHub domains, compromised servers, and other hosting platforms while using lures that impersonate human resources or colleagues and simulate Microsoft Outlook with full-screen loaders that personalize content for the victim. Background scripts inject PHP forms to capture email, password, IP address, geolocation, and organization domain in a single record, and investigators linked the activity to at least two dozen command and control servers and over one hundred GitHub domains as the actor expanded infrastructure and French language lures in 2024 and 2025.
Mythos, MOAK, CTEM and the End of CVE Chasing

www.cycognito.com · 2 months ago

false
Autonomous Vulnerability Hunting with MCP

blog.zsec.uk · 2 months ago

false
ShinyHunters / AT&T ransom payment traced on-chain — paper draft, seeking arXiv cs.CR endorsement

www.google.com · 2 months ago

NULL
Hackers abuse Google ads, Claude.ai chats to push Mac malware

www.bleepingcomputer.com · 2 months ago

Hackers are using Google Ads and shared chats within Claude.ai to distribute malware targeting Mac users. Malicious actors create sponsored search results that appear to lead to legitimate claude.ai download pages, but instead deliver instructions to install malware. The malware, a variant of MacSync, harvests browser credentials, cookies, and keychain contents before exfiltrating them to an attacker-controlled server. Attackers are selectively targeting victims based on keyboard locale and system information, though some variants skip this profiling stage.
Police shut down reboot of Crimenetwork marketplace, arrest admin

www.bleepingcomputer.com · 2 months ago

German authorities have shut down a rebooted version of the Crimenetwork cybercrime marketplace and arrested its administrator. The platform, which operated since 2012 and previously generated over 3.6 million euros, allowed for the sale of illegal goods and services. A 35-year-old man was arrested in Mallorca, Spain, for rebuilding the platform just days after the original shutdown. Police seized approximately 194,000 euros in assets and obtained user data for further investigation.
Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak

thehackernews.com · 2 months ago

Security researchers have identified critical vulnerabilities in the Ollama framework, a tool for running large language models locally. A heap out-of-bounds read flaw, CVE-2026-7482, allows unauthorized attackers to potentially leak sensitive data from process memory. Additionally, two unpatched vulnerabilities, CVE-2026-42248 and CVE-2026-42249, in the Windows update mechanism can be chained to achieve persistent code execution. Users are advised to update to the latest version, restrict network access, and disable automatic updates where possible.
Data in Use Protection: How MPC Keeps Inputs Hidden from the Cloud - Stoffel - MPC Made Simple

stoffelmpc.com · 2 months ago

false
We’ve calculated your chances of winning money on Polymarket

www.washingtonpost.com · 2 months ago

false
The compression of the exploit timeline: Why n-day gaps and 90-day embargoes are failing in practice.

blog.himanshuanand.com · 2 months ago

The security landscape is rapidly changing because of artificial intelligence, making traditional vulnerability disclosure timelines inadequate. Critical vulnerabilities are now being weaponized within days of public disclosure, requiring immediate patching. Security professionals should prioritize instant fixes, use AI defensively for code review and patch analysis, and implement continuous vulnerability management to counter this accelerating threat. Organizations that fail to adapt face increasingly rapid attacks.
Outrunning SHA256 with Physics

blog.floatingpragma.io · 2 months ago

NULL
Memory Poisoning AI Agents via ChromaDB

mamtaupadhyay.com · 2 months ago

A proof of concept demonstrates memory poisoning against AI agents that use persistent vector memory by showing how an attacker with write access to a ChromaDB directory can inject crafted entries with realistic metadata such as session identifiers, backdated timestamps, and authoritative source tags so the payload ranks at the top of retrieval results and is treated as fact without any prompt injection or jailbreak. The attack is hard to detect because the poisoned entry leaves no anomalous logs and appears identical to legitimate memories in retrieval output. The offline PoC built with ChromaDB, an all MiniLM L6 v2 embedding via fastembed on ONNX, and a pure Python HMAC defense shows two mitigations: HMAC signing of content and metadata to reject unsigned entries before they reach the LLM and source scoping to filter cross session injections at retrieval time.
Defence in Depth: A Practical Secure Corporate Network Topology

blogs.official-biswadeb941.in · 2 months ago

A practical enterprise security architecture guide outlines defense in depth strategies to secure corporate networks. Key focus areas include identifying and mitigating single points of failure, managing insider threats, and implementing layered controls within realistic budget constraints.
JDownloader site hacked to replace installers with Python RAT malware

www.bleepingcomputer.com · 2 months ago

The JDownloader website was compromised, with attackers modifying download links to distribute malicious Windows and Linux installers to users who downloaded installers from May 6 to May 7, 2026. The Windows installer acted as a loader that deployed a heavily obfuscated Python based remote access trojan capable of running modular Python code received from remote command and control servers. The modified Linux shell installer downloaded a disguised archive, extracted ELF binaries including a SUID root binary named systemd exec, copied the main payload to root user storage, created persistence via a script in /etc/profile.d, and launched the malware while masquerading as an upowerd process. Developers took the site offline, advised users to confirm installers are digitally signed by AppWork GmbH, and recommended reinstalling affected systems and resetting credentials for anyone who ran the malicious installers.
Technical Analysis of EagleSpy V6.0 (CraxsRAT Rebrand) Distributed Through Odysee and Telegram

odysee.com · 2 months ago

An individual operating through Odysee and Telegram is selling a malicious Android RAT named EagleSpy V6.0 that appears to be a rebranded version of CraxsRAT. An investigation found the buyer was financially scammed after payment and the seller blocked communication, and analysis of the malware infrastructure and repository revealed evidence of real victim infrastructure and compromised device information. Technical analysis confirmed capabilities including banking phishing overlays, crypto wallet credential theft, Telegram bot exfiltration, remote shell execution, keylogging, camera and microphone access, GPS tracking, ransomware components, DEX packing for antivirus evasion, and hidden update and backdoor mechanisms. The malware appears capable of targeting not only victims but potentially buyers and operators through embedded update systems and hidden control mechanisms, and reports have been submitted to platform abuse teams.
Getting LLMs Drunk to Find Remote Linux Kernel OOB Writes (and More)

heyitsas.im · 2 months ago

There are more than twenty CVEs discovered by an autonomous LLM-based vulnerability-hunting harness, including remote unauthenticated out-of-bounds writes in the Linux kernel ksmbd identified as CVE-2026-31432 and CVE-2026-31433. These ksmbd issues arise when a compound sequence of SMB operations lets a first operation consume most of the kernel reply buffer and a following operation append variable-length metadata without proper bounds checking, causing memory corruption that reached adjacent kernel objects in lab testing and could enable a proof-of-concept remote code execution under weakened hardening. The system also found multiple other high-impact flaws such as CUPS CVE-2026-34980 and CVE-2026-34990 which chain from unauthenticated network access to root file overwrite, and Docker CVE-2026-34040 where crafted API requests can bypass body-inspecting authorization. The harness uses a multi-agent pipeline that seeds targets, generates hypotheses from docs and source, iterates on proofs of concept in sandboxed virtual machines, grades findings, and submits maintainer-facing reports while deliberately tuning models to be more exploratory or effectively "drunk" to improve discovery.
Fake OpenAI repository on Hugging Face pushes infostealer malware

www.bleepingcomputer.com · 2 months ago

A malicious repository on Hugging Face impersonated OpenAI's Privacy Filter project, briefly reached the platform's trending list with about 244,000 downloads, and was removed after researchers at HiddenLayer discovered it on May 7, 2026. Its loader.py script disabled SSL verification, decoded and fetched a payload that executed PowerShell to download a batch file which performed privilege escalation, added a final Rust based infostealer named sefirah to antivirus exclusions, and executed it. The infostealer harvests browser data including cookies and saved passwords, Discord tokens, cryptocurrency wallets and extensions, SSH FTP and VPN credentials, local files and wallet seeds, and screenshots, employs multiple anti analysis checks to evade detection, and affected users are advised to reimage machines, rotate credentials, replace wallets and invalidate browser sessions.
TCLBANKER Malware Leverages WhatsApp and Outlook Worm Features in Active Attacks

gbhackers.com · 2 months ago

A sophisticated Brazilian banking trojan named TCLBANKER is being distributed through a trojanized Logitech installer and can hijack victims' WhatsApp and Outlook accounts to self propagate. The campaign tracked as REF3076 delivers a malicious MSI bundled in a ZIP and abuses a signed Logi AI Prompt Builder application via DLL sideloading, loading a malicious screen retriever plugin that deploys two.NET Reactor protected payloads, a banking module and a worm module. The malware employs environment dependent payload decryption, extensive anti analysis checks, geofencing to restrict operations to Brazil, a full screen overlay for credential harvesting and vishing coordination, a WhatsApp worm that clones browser profiles and uses Selenium to send phishing messages, and an Outlook module that sends invoice themed phishing emails from victims' accounts. Operators host command and control and delivery infrastructure through a single Cloudflare Workers account, researchers link the operation to the MAVERICK SORVEPOTEL family, and multiple indicators of compromise are published for detection and mitigation.
Canvas hack exposes schools’ vulnerability to cyberattacks

www.washingtonpost.com · 2 months ago

A widespread breach of the Canvas education platform exposed personally identifying information from almost nine thousand schools and about 275 million people after a group calling itself ShinyHunters claimed responsibility. Instructure said attackers exploited an issue related to Free-for-Teacher accounts, forcing Canvas offline during finals and prompting many schools to delay deadlines and restrict access while they investigate. Security experts warned the incident underscores the systemic risk of a small number of edtech platforms holding vast student data, increasing the likelihood of sophisticated phishing, identity theft and ransom extortion. The breach follows other major education sector incidents and has renewed calls for stronger vendor security, clearer enforcement of student privacy laws and limits on classroom technology use.
Inside Ben Shapiro’s MAGA meltdown

www.washingtonpost.com · 2 months ago

false
cPanel, WHM Release Fixes for Three New Vulnerabilities — Patch Now

thehackernews.com · 2 months ago

There are three new vulnerabilities in cPanel and Web Host Manager that could allow privilege escalation, arbitrary code execution, and denial of service. They are tracked as CVE-2026-29201, an arbitrary file read via insufficient validation of the feature LOADFEATUREFILE adminbin call; CVE-2026-29202, insufficient validation of the plugin parameter in the createuser API that could lead to arbitrary Perl code execution as the affected user; and CVE-2026-29203, unsafe symlink handling that lets a user change permissions of arbitrary files via chmod, enabling denial of service or possible privilege escalation. Patches are available in multiple cPanel and WHM release versions and a direct update 110.0.114 was issued for customers on CentOS 6 or CloudLinux 6, and users are urged to update promptly; there is no evidence of exploitation in the wild, though a recently weaponized cPanel flaw CVE-2026-41940 was noted.
Vidar Infostealer Campaign Steals Passwords, Cookies, Crypto Wallets, and Device Data

gbhackers.com · 2 months ago

A multi-stage malware campaign is using the Vidar infostealer to steal passwords, browser cookies, cryptocurrency wallet information, and device data. Attackers are using a commonly abused software activation tool, MicrosoftToolkit.exe, to initiate the infection, followed by AutoIt scripting to disguise malicious activity and evade detection. The malware employs techniques such as file renaming, process reconnaissance, and memory analysis avoidance to maintain stealth, and communicates with command-and-control servers through legitimate services like Telegram and Steam. The malware then deletes files and terminates processes to erase traces of the attack.
NVIDIA Confirms GeForce Data Breach Exposed Users’ Personal Data

gbhackers.com · 2 months ago

GFN.AM, a regional partner of NVIDIA GeForce NOW, has confirmed a data breach affecting users of their cloud gaming platform. Unauthorized access to an internal database occurred on March 9, 2026, and was not discovered until May 2, 2026. Exposed information includes email addresses, account usernames, dates of birth, phone numbers for mobile operator registrants, and names for users utilizing Google single sign-on. While passwords were not compromised, the leaked personal data increases the risk of targeted phishing and social engineering attacks.
Seclens: Role-specific Evaluation of LLM's for security vulnerablity detection

arxiv.org · 2 months ago

A new framework, SecLens-R, has been developed to evaluate large language models for security vulnerability detection, addressing the limitations of current single-metric benchmarks. The framework incorporates the distinct priorities of different roles, such as chief information security officers and engineering leaders, by using role-specific weighting profiles. Evaluations of 12 language models across various settings revealed significant differences in performance based on stakeholder perspectives. The research highlights that vulnerability detection is a multi-objective problem, and stakeholder-aware evaluations offer more nuanced insights.
ShinyHunters Extorts Universities in New Instructure Canvas Hack

www.techrepublic.com · 2 months ago

ShinyHunters linked attackers defaced Canvas login portals, locking students out of coursework, quizzes, and grades during finals week and affecting approximately 330 educational institutions. The group claimed roughly 280 million student and staff records tied to more than 8,800 schools were stolen and issued extortion demands while Instructure confirmed data was accessed and placed Canvas into maintenance mode. Reports indicate the attackers exploited a vulnerability that allowed modification of institutional login pages, highlighting risks of centralized cloud based education platforms and prompting recommendations such as enforcing role based access controls, phishing resistant multifactor authentication, restricting API access, centralized logging, maintaining offline backups, and testing incident response plans.
Friday Squid Blogging: Giant Squid Live in the Waters of Western Australia

www.schneier.com · 2 months ago

false
Five new holes, one exploited, found in Ivanti Endpoint Manager Mobile

www.csoonline.com · 2 months ago

Security researchers have identified five vulnerabilities in Ivanti’s Endpoint Manager Mobile (EPMM) suite, prompting a warning from cybersecurity experts to prioritize patching and consider a shift away from legacy systems. One vulnerability, CVE-2026-6973, is actively exploited and allows remote code execution with administrative access. Experts recommend rotating administrative credentials after patching due to the possibility of existing compromises, and disabling Apple Device Enrolment if not in use. Ivanti is utilizing AI tools to proactively identify vulnerabilities, and organizations should review their security posture and consider a Zero Trust model. Other identified vulnerabilities include CVE-2026-5787, CVE-2026-5786, CVE-2026-5788, and CVE-2026-7821.