Blahalla

Cyber Espionage Group Targets Aviation Firms to Steal Map Data

www.darkreading.com · 2 months ago

A cyber espionage group known as HeartlessSoul has targeted aerospace and drone operators to exfiltrate geospatial information including GIS files, terrain models, and GPS data to build detailed operational awareness. The group used tailored phishing and malvertising, created fake domains and installer sites, and even uploaded a malicious archive to a legitimate download service to deliver a JavaScript remote access trojan, PowerShell scripts, fileless execution techniques, and malicious LNK files. Compromised data types include GPS logs, GIS shapefiles, digital relief files, proprietary mapping files, and other documents, and some LNK files exploited a Windows shortcut vulnerability tracked as ZDI-CAN-25373. Security guidance recommends hunting for indicators, protecting GIS and flight‑planning systems with identity‑bound access and egress monitoring, segmenting engineering networks from business networks, and applying zero-trust protections to workstations that handle crown-jewel mapping data.
Skoda Data Breach Hits Online Shop Customers

www.securityweek.com · 2 months ago

There was a data breach affecting Skoda online shop customers that was discovered through technical security monitoring and caused by a vulnerability in the portal software. Attackers accessed customer names, addresses, email addresses, phone numbers, order details, user account information, and password hashes, while no credit card data was compromised because payments are handled by third party providers, and Skoda cannot determine if or to what extent data was exfiltrated or how many people were affected. Skoda took the shop offline, patched the vulnerability, retained external forensics experts, notified authorities, and advised customers to watch for phishing, avoid clicking suspicious links, and change reused passwords.
Your Purple Team Isn't Purple — It's Just Red and Blue in the Same Room

thehackernews.com · 2 months ago

Purple teaming aims to create a continuous loop where red finds attacker paths and blue validates detections, but system workflows and messy handoffs mean teams still often behave as separate red and blue functions. Three operational barriers are human friction, fragmented orchestration of teams and tools, and the inability to keep pace with AI-powered attackers; exploitation windows shrank from a mean of 56 days in 2024 to about 23 days in 2025 and roughly 10 hours so far in 2026 across more than three thousand CVE-exploit pairs, while AI-assisted attackers can compromise systems in about 73 seconds and defenders commonly take at least 24 hours to deploy fixes. Autonomous purple teaming uses automated penetration testing, breach and attack simulation, and chains of AI agents to turn red findings into blue tests, automate low-risk fixes, and maintain an auditable machine-speed loop with human review when needed.
Cloudflare Lays Off 1,100 Employees in AI-Driven Restructuring

www.securityweek.com · 2 months ago

Cloudflare is cutting more than 1,100 jobs worldwide as part of an AI driven restructuring after internal AI usage rose by over 600 percent in the prior three months. Affected employees will receive severance equal to their full base salary through the end of 2026, US healthcare coverage through December 31, 2026, accelerated equity vesting through August 15, 2026, and waived or pro rated vesting for those who have not reached a one year cliff. The company beat revenue and earnings forecasts for the first quarter of 2026, but its shares tumbled more than 20 percent following the layoff announcement and softer near term guidance.
LLMs and Text-in-Text Steganography

www.schneier.com · 2 months ago

Large language models can hide meaningful messages inside otherwise ordinary coherent text, enabling text-in-text steganography. A demonstrated protocol encodes and decodes messages of the same length using even modest eight billion parameter models, and can run locally on a laptop in seconds, creating covert channels that can bypass content filters. This decoupling of text from authorial intent raises urgent trust, safety, and content moderation challenges and points to the need for detection tools and policy responses.
Fake Claude Campaign Uses PlugX-Style DLL Sideloading Chain

gbhackers.com · 2 months ago

Hackers are abusing a fake Claude AI download site to deliver a PlugX-style DLL sideloading chain that drops NOVupdate.exe NOVupdate.exe.dat and avk.dll into the Startup folder and leverages a signed G DATA updater to load a malicious avk.dll. The chain decrypts shellcode which uses DonutLoader to execute a previously undocumented Windows backdoor named Beagle that can execute arbitrary commands upload and download files list and remove directories rename files and uninstall itself. Beagle communicates with command and control over TCP port 443 and UDP port 8080 using AES with a hardcoded key and per-packet IVs and the campaign uses Cloudflare fronting and specific IP infrastructure. Organizations are advised to obtain AI tool downloads only from official vendor domains and to detect signed G DATA executables loading nonstandard avk.dll files encrypted outbound traffic to the campaign domains and in-memory DonutLoader activity.
SailPoint Discloses GitHub Repository Hack

www.securityweek.com · 2 months ago

On April 20, 2026, unauthorized access to a subset of SailPoint's GitHub repositories was detected and immediately contained. The repositories were compromised via a vulnerability in a third party application that has since been addressed. An investigation conducted with an external cybersecurity firm found no evidence that customer data in SailPoint's production or staging environments was accessed or that services were interrupted. SailPoint directly notified customers whose information was stored in the accessed repositories, advised generally that no further action is required, did not name a threat actor and did not disclose additional details making any link to recent supply chain attacks unclear.
Microsoft 365 Copilot Flaws Could Let Attackers Access Sensitive Data

gbhackers.com · 2 months ago

There are three critical information disclosure vulnerabilities affecting Microsoft 365 Copilot and Copilot Chat in Microsoft Edge, disclosed May 7, 2026, that could allow attackers to bypass security boundaries and access sensitive enterprise data. The flaws, tracked as CVE-2026-26129, CVE-2026-26164, and CVE-2026-33111, each have CVSS 3.1 base scores of 7.5, require no privileges or user interaction, and exploit improper input handling and injection weaknesses in the Copilot processing pipeline and the Edge chat context. Microsoft has deployed backend fixes to the fully managed Copilot service and reports that no customer action is required to mitigate these information disclosure risks.
Trending Hugging Face Repo With 200K Downloads Spreads Windows Malware

gbhackers.com · 2 months ago

A malicious Hugging Face repository named Open-OSS/privacy-filter abused the platform’s trust and trending algorithm to appear legitimate, briefly reaching the number one trending position with about 244,000 downloads and hundreds of likes before removal. The repository typosquatted a legitimate Privacy Filter release, instructed users to run start dot bat or loader dot py on Windows, and the loader disabled SSL verification, fetched execution commands from a remote JSON paste, and invoked a hidden PowerShell one liner that downloaded an update script which elevated privileges, fetched a final payload, added Microsoft Defender exclusions, and scheduled a one shot task to run the payload as system. The final roughly one megabyte Rust based infostealer contains anti analysis and virtual machine detection, attempts to disable AMSI and ETW, harvests browser credentials, session tokens, cryptocurrency wallet data, FTP SSH and VPN files, and exfiltrates compressed data over HTTPS to a command and control server, so any Windows system that executed the repository files should be treated as fully compromised with full reimaging and credential rotation recommended.
Sandboxie Escape Flaw Could Let Attackers Gain SYSTEM-Level Privileges

gbhackers.com · 2 months ago

There are critical sandbox escape vulnerabilities in Sandboxie and Sandboxie-Plus that allow attackers to bypass isolation and obtain full SYSTEM level privileges. The flaws include CVE-2026-34459, a stack based buffer overflow in the SbieSvc GetRawInputDeviceInfoSlave handler that enables an ASLR bypass and return oriented programming chain, CVE-2026-34458, a configuration file injection via unsanitized carriage return and line feed handling, CVE-2026-32603, a local denial of service that triggers a kernel crash, and CVE-2026-34527, a hashing implementation error that reduces stored password entropy. These vulnerabilities affect Sandboxie versions 1.17.2 and earlier and can be chained to escalate privileges even against hardened sandbox configurations. The issues have been fixed in subsequent builds and users are urged to update to version 1.17.5 or uninstall vulnerable installs and then install the patched release.
AI security is repeating endpoint security’s biggest mistake

www.csoonline.com · 2 months ago

There is déjà vu in security as many teams treat AI security like a posture problem, relying on model cards, software bills of materials, input and output filters, prompt injection guardrails and access controls while the AI surface rapidly expands. That posture first approach is brittle because open source models deployed without review, third party model APIs embedded in SaaS, autonomous agents with broad access and retrieval augmented generation pipelines that touch sensitive data create shadow AI and dynamic opaque attack surfaces posture alone cannot secure. Behavioral detection that logs and analyzes action sequences such as unusual data access patterns, prompt injection artifacts, unexpected tool calls and token velocity anomalies provides the signal SOC teams need to triage incidents rather than audit findings. Organizations should retain posture controls but start recording AI behavior now, prioritize highest agency surfaces, think in sequences not single events and route behavioral telemetry to the SOC for detection and response.
Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack

www.securityweek.com · 2 months ago

A maliciously modified version of the Checkmarx Jenkins AST plugin was published to the Jenkins Marketplace as part of a supply chain attack. Checkmarx warned users and advised ensuring they are running version 2.0.13-829.vc72453fa1c16 published in December 2025, and released two new plugin versions over the weekend with the latest now available on GitHub and the Jenkins Marketplace. The compromise is tied to the Trivy supply chain attack that allowed the TeamPCP group to access Checkmarx repositories in late March, followed by additional malicious artifacts and alleged data leaked by the Lapsus extortion group.
PoC Exploit Released for Android Zero-Click Flaw Enabling Remote Shell Access

gbhackers.com · 2 months ago

A public proof of concept is circulating for CVE-2026-0073, a critical no-interaction remote code execution flaw in Android's adbd that can grant shell access when wireless ADB is reachable on a network. The weakness stems from a logic error in adbdtlsverifycert that can cause a crafted TLS client certificate to be treated as trusted, bypassing mutual authentication and allowing an unauthorized ADB host to open a shell session. Defenders are urged to apply the May 2026 Android security update, disable wireless debugging where not needed, and treat any LAN or internet reachable ADB service as a sensitive attack surface because public exploit references increase the likelihood of opportunistic scanning and targeted abuse.
TrickMo Android banker adopts TON blockchain for covert comms

www.bleepingcomputer.com · 2 months ago

A new variant of the TrickMo Android banking malware is being delivered in campaigns across Europe and targets banking credentials and cryptocurrency wallets in France, Italy, and Austria. It uses The Open Network TON overlay for covert command and control by resolving operator endpoints as.adnl identities through an embedded local TON proxy on infected devices, which hides IP addresses and makes traditional domain takedowns and network edge detection ineffective. The malware retains a modular two stage design and adds network diagnostic and proxying commands including curl, dnsLookup, ping, telnet, traceroute, SSH tunneling, remote and local port forwarding, and authenticated SOCKS5 proxy support while continuing to perform phishing overlays, keylogging, screen recording, SMS interception, one time password suppression, clipboard modification, notification filtering, and screenshot capture.
8 guiding principles for reskilling the SOC for agentic AI

www.csoonline.com · 2 months ago

There are eight guiding principles for reskilling security operations for agentic AI, including embracing the agentic imperative, setting the tone from the top, respecting resistance while overcoming it, and providing hands-on, sandboxed training. Security leaders report embedding vendor experts, running bootcamps and internal sandboxes such as LabX to encourage rapid experimentation while redeploying humans into higher-value oversight and automation design roles. Organizations are urged to emphasize governance and human-in-the-loop controls with escalation paths, audit trails and override authorities, to rethink operating models and career ladders as L1 and L2 functions become agentic, and to train analysts in model intuition and policy setting so agents operate within defined decision boundaries.
See the hidden rules behind AI. Then use them to rewrite this article.

www.washingtonpost.com · 2 months ago

There are thousands of words of hidden instructions called system prompts that companies inject into every chatbot conversation to steer personality, policy compliance, and tool use, and those instructions can take priority over what a user types. Researchers who extracted system prompts found they range from a few hundred to more than twenty thousand words and include specific rules such as forbidding unnecessary discussion of goblins and strict limits on quoting copyrighted material. Companies generally keep full system prompts secret and offer only limited personalization features that let users request tone or formatting changes but not directly edit the underlying instructions.
1,800+ MCP servers exposed without authentication: How zero trust can secure the AI agent revolution

www.csoonline.com · 2 months ago

There are widespread exposures of Model Context Protocol servers, with 1,862 publicly reachable instances identified and a verified sample of 119 that all permitted unauthenticated access to internal tool listings. Exposed servers include production systems with write access to financial databases, social media accounts, and customer relationship management platforms, creating opportunities for tool poisoning, rug pulls, and cross-server contamination that enable stealthy data exfiltration. Researchers have documented high-impact vulnerabilities, including EchoLeak CVE-2025-32711, a zero-click technique that hides malicious instructions in documents to coerce Microsoft 365 Copilot into exfiltrating data, and mcp-remote CVE-2025-6514, a JFrog package command injection via unsanitized OAuth parameters that can yield full system compromise. Security recommendations include adopting the Agentic Trust Framework and zero-trust controls such as identity governance for agents, mandatory authentication and authorization for every interaction, cryptographic signing and immutable versioning of tool definitions, network segmentation, continuous behavioral monitoring, and human-in-the-loop approval for sensitive operations.
Canvas System Is Online After a Cyberattack Disrupted Thousands of Schools

www.securityweek.com · 2 months ago

On May 11, 2026, tens of thousands of students regained access to the Canvas online learning system after a cyberattack had knocked the platform offline during finals, forcing schools to reschedule exams and seek workarounds. Instructure reported that an unauthorized actor made changes to pages visible to logged in users and that the attacker exploited an issue related to Free For Teacher accounts, which the company temporarily disabled while investigating. A hacking collective claiming to be ShinyHunters said nearly nine thousand schools were affected and that billions of private messages and records were accessed, and Instructure has not confirmed whether a ransom was paid or which data was compromised.
OpenClaw Malware Targets Crypto Wallets and Bitwarden Credentials

gbhackers.com · 2 months ago

OpenClaw users are being targeted by a malware campaign that distributes a fake OpenClaw Windows installer containing a 130 megabyte Rust executable named Hologram padded with fake documentation to evade antivirus and sandbox file size limits. After multi layer anti virtual machine checks that can wait for real mouse movement, the dropper decodes and runs an obfuscated PowerShell payload that disables Microsoft Defender, opens inbound firewall ports, retrieves a password protected archive and drops multiple Rust based modules that establish resilient persistence and Telegram based callbacks via a Hookdeck relay. The stage two Stealth Packer framework includes six Rust components that execute payloads entirely in memory using techniques such as hosting the.NET CLR inside Rust and reflectively executing decrypted PE files via direct NT syscalls, and it uses a server side manifest to target 250 browser extensions including 201 crypto wallet extensions such as MetaMask, Phantom, Coinbase and OKX, plus 49 password managers including Bitwarden, LastPass and 1Password. Operators also deploy a separate Ledger Live module to steal funds and rely on legitimate cloud services including Azure DevOps, Telegram and Hookdeck for command and control, making detection difficult and requiring defenders to inspect application layer traffic rather than rely on IP only perimeter controls.
MyAudi app:Security issues in Audi Connected Vehicle experience

decoder.cloud · 2 months ago

A security researcher found that the myAudi connected vehicle platform allows anyone who knows a vehicle identification number to add that vehicle as a guest user and access sensitive vehicle and ownership information. Some GraphQL endpoints had introspection enabled exposing API schemas, and vehicle management endpoints returned embedded SIM identifiers such as IMEI and ICCID along with license and service metadata. Guest users could poll and retrieve pending requests initiated by primary users, including honk and flash responses that contained the requesting user's GPS location and unlock status; that specific issue has been fixed following disclosure while other findings remain under evaluation and a full review of vehicle association logic was recommended.
New ‘Dirty Frag’ Linux Vulnerability Possibly Exploited in Attacks

www.securityweek.com · 2 months ago

A newly disclosed local privilege escalation vulnerability affecting major Linux distributions, called Dirty Frag and Copy Fail 2 and tracked as CVE-2026-43284 and CVE-2026-43500, can allow an unprivileged user to escalate permissions to root. The exploit chains two kernel flaws affecting the xfrm-ESP and RxRPC components, was publicly disclosed before patches were available, and technical details and proof of concept code were made available online. Microsoft and other vendors report limited in the wild activity that may indicate exploitation, including post compromise modification of authentication and PHP session files. Linux distributors including Red Hat, Amazon Linux, Ubuntu, Fedora and AlmaLinux have released patches and mitigations and organizations are advised to apply updates.
Giving Claude Code Full Control of a Hardware Fault Injection Setup to Bypass Secure Boot

raelize.com · 2 months ago

Researchers used an autonomous Claude Code agent to reproduce a fault injection attack that bypassed Secure Boot V1 on an Espressif ESP32 system on chip using voltage crowbar glitches. The AI wrote all of the software tooling and orchestrated hardware including a ChipWhisperer Husky, an RK6006 power supply, a PicoScope, and an ESP-PROG adapter, reverse-engineered and emulated the rev-0 boot ROM, ran thousands of glitch attempts, and built a live monitoring dashboard while the campaign ran. The issue is specific to ESP32 Secure Boot V1 and was mitigated in ESP32 V3 by modifying ROM code, though related fault injection risks remain.
Crimenetwork Bust Reveals 22,000 Members and Over 100 Illicit Vendors

gbhackers.com · 2 months ago

Law enforcement dismantled the relaunched Crimenetwork online marketplace after arresting a 35 year old German national at his residence in Mallorca, Spain on a European Arrest Warrant. Investigators seized about 194,000 euros in physical and digital assets, recovered user databases and transaction logs, and found the site had grown to more than 22,000 registered users and over 100 active vendors trading stolen data, narcotics and forged identification. The marketplace used Bitcoin, Litecoin and Monero to process payments and generated more than 3.6 million euros in revenue while charging commissions and recurring vendor fees. The operation was a coordinated effort between German, Spanish, Moldovan and European agencies and follows a March 2026 conviction that resulted in a seven year ten month prison sentence and the confiscation of over ten million euros for the previous operator.
Resurrected ‘Crimenetwork’ Marketplace Taken Down, Administrator Arrested

www.securityweek.com · 2 months ago

German police shut down the second iteration of the German speaking Crimenetwork marketplace and arrested a 35 year old man suspected to be its administrator. The resurrected marketplace had grown to more than 22,000 users and over 100 sellers and facilitated trade in stolen information, drugs, and falsified documents using cryptocurrencies such as Bitcoin, Litecoin, and Monero. Investigators say the platform generated more than 3.6 million euros in revenue and law enforcement seized about 194,000 euros along with extensive user and transaction data for further analysis. The original Crimenetwork had been taken down in December 2024 after more than a decade of operation and investigators estimated that over 100 million dollars in cryptocurrency passed through it between 2018 and 2024.
ShinyHunters Exploits Canvas LMS Free Teacher Accounts in New Breach

gbhackers.com · 2 months ago

ShinyHunters exploited Canvas LMS Free‑For‑Teacher accounts in early May 2026 to access production tenant data across thousands of schools worldwide. The exposure window ran from April 30 to May 7 2026, the group claimed responsibility on May 3 and posted a ransom note threatening to leak data while claiming to hold 3.6 terabytes of data covering roughly 275 million users across about 9,000 schools. Instructure took Canvas services offline, permanently shut down the FFT program, rotated privileged API keys and is working with forensic investigators and law enforcement while stating it has found no evidence so far that passwords, dates of birth, government identifiers, or financial information were accessed, though names, email addresses, student ID numbers and some private messages were exfiltrated, increasing the risk of targeted phishing.
Fake OpenAI Privacy Filter Repo Hits #1 on Hugging Face, Draws 244K Downloads

thehackernews.com · 2 months ago

A malicious Hugging Face repository impersonated OpenAI's Privacy Filter open-weight model, copied the legitimate model card, and briefly reached the platform's top trending position with roughly 244,000 downloads before being disabled. The project provided Windows and cross-platform loaders that disabled SSL verification, used a public JSON paste service to retrieve commands, invoked PowerShell to download a second-stage downloader that elevated privileges and configured antivirus exclusions, and ultimately delivered a Rust-based information stealer that harvested screenshots, messaging data, cryptocurrency wallet information, FileZilla configurations, and browser data for exfiltration. Researchers identified multiple other repositories using the same Python loader and tied the shared infrastructure and payload behavior to broader supply chain operations and prior campaigns that deployed a modular remote access trojan attributed to the Silver Fox threat actor.
Windows CreateFileW API Flaw Could Let Attackers Lock SMB Files at Scale

gbhackers.com · 2 months ago

A newly disclosed technique called GhostLock abuses the Windows CreateFileW API to acquire exclusive deny share handles and lock large numbers of SMB files across enterprise network shares without writing or encrypting any data. A proof of concept shows a low privileged domain user can lock up to half a million files in under three minutes, triggering widespread sharing violations that disrupt enterprise resource planning systems and shared workflows while leaving no traditional forensic traces. Detection and response require ingesting storage session telemetry to alert on unusually high numbers of exclusive handles per session and coordinating with storage administrators to forcibly terminate the offending network session because revoking credentials alone will not release the locks.
Weaponized JPEG file Drops Trojanized ScreenConnect Malware

gbhackers.com · 2 months ago

Hackers are abusing a weaponized JPEG named sysupdate.jpeg that contains an obfuscated PowerShell script which, when executed, stages components from attacker infrastructure to install a trojanized ConnectWise ScreenConnect client and establish persistent remote access for surveillance and credential theft. The PowerShell loader compiles a unique launcher executable on the victim using csc.exe, performs a fileless UAC bypass via ComputerDefaults.exe and a crafted ms-settings protocol handler, and installs a malicious Windows service named OneDriveServers that deploys a modified ScreenConnect client connecting to legitserver.theworkpc.com and the hard coded IP 45.138.16.64. The trojanized ScreenConnect instance exposes dozens of operator capabilities including live screen viewing, continuous recording, microphone capture, clipboard and print interception, credential provider hooking to capture login credentials, account lifecycle control, and encrypted command and control using PBKDF2 HMAC SHA256 derived keys. Organizations are advised to block PowerShell execution from untrusted sources, harden UAC and registry policies, monitor ScreenConnect installations and unexpected services such as OneDriveServers, and inspect JPEG files for embedded non image content.
macOS Malware Abuses Google Ads and Claude Shared Chats to Deliver Payloads

gbhackers.com · 2 months ago

There is a sophisticated malvertising campaign targeting macOS users that leverages malicious Google Ads and legitimately shared Anthropic Claude chats to trick developers into executing an obfuscated installation command that delivers a MacSync malware variant. The installation command conceals the payload URL in base64 and pipes the downloaded content into the macOS zsh for immediate execution, with delivery and command and control infrastructure hosted on attacker controlled domains. The payload is identified as a MacSync variant with SHA-256 hash bbd98170ea66c8d13605cb88ad0e18602ef40c0745f7b2c979a8a342a31c1857. Recommended mitigations include enforcing policies against pasting terminal commands from untrusted sources, verifying downloads via official vendor sites, monitoring for anomalous zsh executions, and blocking known malicious command and control domains.
ODINI Malware Uses CPU Magnetic Signals to Exfiltrate Data from Air-Gapped Systems

gbhackers.com · 2 months ago

ODINI is malware that exfiltrates data from air-gapped systems by modulating low-frequency magnetic fields generated through deliberate CPU power consumption, demonstrating that Faraday cages and isolation can be bypassed. It encodes data by rapidly loading and unloading processor cores, transmits at speeds up to 40 bits per second to magnetic receivers placed up to 150 centimeters away, requires no elevated privileges, can operate from inside virtual machines, and evades traditional antivirus detection. Defenses include strict physical zoning to prevent nearby unauthorized sensors, active magnetic signal jamming, and costly ferromagnetic shielding such as mu-metal, each with practical trade-offs.
What It Costs to Hire a Hacker on the Dark Web in 2026

www.techrepublic.com · 2 months ago

Hacker for hire services on the dark web are widely available and are typically paid for with cryptocurrency, covering attacks from distributed denial of service to data theft, social account takeovers, and changing school grades. Distributed denial of service attacks range from ten dollars to two thousand five hundred dollars, with gaming targets typically fifty to two hundred dollars and high value targets such as financial institutions or government networks reaching up to five thousand dollars, and some providers charge by time for example seven dollars and fifty cents per hour thirty five dollars per day and two hundred fifty dollars for longer campaigns. Personal attacks range from ten dollars to over six hundred dollars, access to personal information averages six hundred dollars, a physical US identification card costs about one hundred fifty to one hundred sixty dollars and a European passport is advertised around three thousand eight hundred dollars. Website and database access averages one thousand two hundred dollars with small business compromises as low as six hundred dollars and advanced website crimes costing five thousand to fifty thousand dollars, computer and phone hacking averages nine hundred fifty dollars with phone or email access often five hundred to five thousand dollars and ransomware or large scale extortion typically demanding at least fifty thousand dollars, while social media account takeovers range twenty to five hundred dollars averaging two hundred thirty dollars, email account access averages two hundred forty one dollars and changing grades averages one thousand six hundred dollars.
New cPanel and WHM Vulnerabilities Expose Servers to Code Execution and DoS Attacks

gbhackers.com · 2 months ago

On May 8, 2026, researchers disclosed three severe security flaws affecting cPanel, WebHost Manager and the WP Squared platform that can enable arbitrary code execution, arbitrary file disclosure, and symlink based permission manipulation leading to denial of service and possible local privilege escalation. The flaws are tracked as CVE-2026-29202, a critical Perl code injection in the createuser API via the plugin parameter; CVE-2026-29201, an arbitrary file read in the feature::LOADFEATUREFILE adminbin call; and CVE-2026-29203, unsafe symlink handling that permits chmod on arbitrary files. The vendor released emergency patches and administrators are urged to update to version 11.136.0.9 or higher, apply listed backported fixes for older branches, update WP Squared to 11.136.1.10, and force and verify updates immediately to mitigate exploitation.
JDownloader Hack Spreads New Python RAT

gbhackers.com · 2 months ago

There was a supply chain attack on the official JDownloader website that redirected specific download links to malicious installers containing a heavily obfuscated Python based remote access trojan. Attackers exploited an unpatched content management system vulnerability to redirect the Download Alternative Installer for Windows and the Linux shell installer during a risk window from May 6 through May 7, 2026, and the site was taken offline on May 7 once developers were alerted. The Windows executables were signed with spoofed publisher names and the Linux installer contained injected code that installed a SUID root launcher and disguised the payload to evade detection. Eight malicious Windows installers and one compromised Linux installer were identified, and users who ran the compromised installers are advised to reinstall their operating systems and verify downloads by comparing SHA256 checksums and file sizes against the vendor’s incident report.
Top 10 Best Secure Code Review Services For Developers in 2026

gbhackers.com · 2 months ago

There are ten leading secure code review services for developers in 2026 that emphasize shifting security left by combining automated analysis with expert manual review to identify and remediate vulnerabilities earlier. Key trends include AI powered detection, stronger focus on software supply chain and open source component analysis, cloud native and container awareness, and deep integration of secure code review into CI CD pipelines to provide contextual, actionable remediation for developers. The market spans developer centric platforms offering real time feedback, pentesting as a service for collaborative offensive testing, and enterprise platforms that prioritize accuracy, low false positives, scalability, and compliance reporting.
Top 10 Best DevSecOps Companies For Secure SDLC 2026

gbhackers.com · 2 months ago

There is growing urgency to embed security across the software development life cycle as the DevSecOps market, valued at roughly USD 2.8 billion in 2024, is projected to reach USD 23.1 billion by 2033. Key 2026 trends driving adoption include accelerated release cycles, cloud native and container complexities, software supply chain attacks, AI and machine learning risks, and tighter data privacy regulations, making shift left security and continuous testing essential. A vendor comparison highlights Snyk, Checkmarx, GitLab, Veracode, Aqua, ArmorCode, SonarQube, Fortify, Lacework, and Contrast Security, noting varying coverage of SAST, DAST, SCA, IAST, infrastructure as code scanning, container and API security, and AI assisted features that make some platforms more developer focused and others better suited to large enterprises.
Over 500 Organizations Hit in Years-Long Phishing Campaign

www.securityweek.com · 2 months ago

Operation HookedWing is a years-long phishing campaign that has stolen more than two thousand user credentials across over five hundred organizations in aviation, travel, critical infrastructure, energy, financial, government, logistics, public administration, and technology sectors. The campaign, active since at least 2022, relied on GitHub domains, compromised servers, and other hosting platforms while using lures that impersonate human resources or colleagues and simulate Microsoft Outlook with full-screen loaders that personalize content for the victim. Background scripts inject PHP forms to capture email, password, IP address, geolocation, and organization domain in a single record, and investigators linked the activity to at least two dozen command and control servers and over one hundred GitHub domains as the actor expanded infrastructure and French language lures in 2024 and 2025.
Mythos, MOAK, CTEM and the End of CVE Chasing

www.cycognito.com · 2 months ago

false
Autonomous Vulnerability Hunting with MCP

blog.zsec.uk · 2 months ago

false
ShinyHunters / AT&T ransom payment traced on-chain — paper draft, seeking arXiv cs.CR endorsement

www.google.com · 2 months ago

NULL
Hackers abuse Google ads, Claude.ai chats to push Mac malware

www.bleepingcomputer.com · 2 months ago

Hackers are using Google Ads and shared chats within Claude.ai to distribute malware targeting Mac users. Malicious actors create sponsored search results that appear to lead to legitimate claude.ai download pages, but instead deliver instructions to install malware. The malware, a variant of MacSync, harvests browser credentials, cookies, and keychain contents before exfiltrating them to an attacker-controlled server. Attackers are selectively targeting victims based on keyboard locale and system information, though some variants skip this profiling stage.
Police shut down reboot of Crimenetwork marketplace, arrest admin

www.bleepingcomputer.com · 2 months ago

German authorities have shut down a rebooted version of the Crimenetwork cybercrime marketplace and arrested its administrator. The platform, which operated since 2012 and previously generated over 3.6 million euros, allowed for the sale of illegal goods and services. A 35-year-old man was arrested in Mallorca, Spain, for rebuilding the platform just days after the original shutdown. Police seized approximately 194,000 euros in assets and obtained user data for further investigation.
Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak

thehackernews.com · 2 months ago

Security researchers have identified critical vulnerabilities in the Ollama framework, a tool for running large language models locally. A heap out-of-bounds read flaw, CVE-2026-7482, allows unauthorized attackers to potentially leak sensitive data from process memory. Additionally, two unpatched vulnerabilities, CVE-2026-42248 and CVE-2026-42249, in the Windows update mechanism can be chained to achieve persistent code execution. Users are advised to update to the latest version, restrict network access, and disable automatic updates where possible.
Data in Use Protection: How MPC Keeps Inputs Hidden from the Cloud - Stoffel - MPC Made Simple

stoffelmpc.com · 2 months ago

false
We’ve calculated your chances of winning money on Polymarket

www.washingtonpost.com · 2 months ago

false
The compression of the exploit timeline: Why n-day gaps and 90-day embargoes are failing in practice.

blog.himanshuanand.com · 2 months ago

The security landscape is rapidly changing because of artificial intelligence, making traditional vulnerability disclosure timelines inadequate. Critical vulnerabilities are now being weaponized within days of public disclosure, requiring immediate patching. Security professionals should prioritize instant fixes, use AI defensively for code review and patch analysis, and implement continuous vulnerability management to counter this accelerating threat. Organizations that fail to adapt face increasingly rapid attacks.
Outrunning SHA256 with Physics

blog.floatingpragma.io · 2 months ago

NULL
Memory Poisoning AI Agents via ChromaDB

mamtaupadhyay.com · 2 months ago

A proof of concept demonstrates memory poisoning against AI agents that use persistent vector memory by showing how an attacker with write access to a ChromaDB directory can inject crafted entries with realistic metadata such as session identifiers, backdated timestamps, and authoritative source tags so the payload ranks at the top of retrieval results and is treated as fact without any prompt injection or jailbreak. The attack is hard to detect because the poisoned entry leaves no anomalous logs and appears identical to legitimate memories in retrieval output. The offline PoC built with ChromaDB, an all MiniLM L6 v2 embedding via fastembed on ONNX, and a pure Python HMAC defense shows two mitigations: HMAC signing of content and metadata to reject unsigned entries before they reach the LLM and source scoping to filter cross session injections at retrieval time.
Defence in Depth: A Practical Secure Corporate Network Topology

blogs.official-biswadeb941.in · 2 months ago

A practical enterprise security architecture guide outlines defense in depth strategies to secure corporate networks. Key focus areas include identifying and mitigating single points of failure, managing insider threats, and implementing layered controls within realistic budget constraints.
JDownloader site hacked to replace installers with Python RAT malware

www.bleepingcomputer.com · 2 months ago

The JDownloader website was compromised, with attackers modifying download links to distribute malicious Windows and Linux installers to users who downloaded installers from May 6 to May 7, 2026. The Windows installer acted as a loader that deployed a heavily obfuscated Python based remote access trojan capable of running modular Python code received from remote command and control servers. The modified Linux shell installer downloaded a disguised archive, extracted ELF binaries including a SUID root binary named systemd exec, copied the main payload to root user storage, created persistence via a script in /etc/profile.d, and launched the malware while masquerading as an upowerd process. Developers took the site offline, advised users to confirm installers are digitally signed by AppWork GmbH, and recommended reinstalling affected systems and resetting credentials for anyone who ran the malicious installers.
Technical Analysis of EagleSpy V6.0 (CraxsRAT Rebrand) Distributed Through Odysee and Telegram

odysee.com · 2 months ago

An individual operating through Odysee and Telegram is selling a malicious Android RAT named EagleSpy V6.0 that appears to be a rebranded version of CraxsRAT. An investigation found the buyer was financially scammed after payment and the seller blocked communication, and analysis of the malware infrastructure and repository revealed evidence of real victim infrastructure and compromised device information. Technical analysis confirmed capabilities including banking phishing overlays, crypto wallet credential theft, Telegram bot exfiltration, remote shell execution, keylogging, camera and microphone access, GPS tracking, ransomware components, DEX packing for antivirus evasion, and hidden update and backdoor mechanisms. The malware appears capable of targeting not only victims but potentially buyers and operators through embedded update systems and hidden control mechanisms, and reports have been submitted to platform abuse teams.