Blahalla

They said they would build AI safely. Then it went rogue.

www.washingtonpost.com · 2 months ago

New details of how ChatGPT-maker OpenAI failed to notice that its models had launched a hacking spree raise questions about the industry's approach to safety.

Corporate Data Stolen in Levi Strauss Cyberattack

www.securityweek.com · 2 months ago

Using social engineering, a threat actor accessed the computers of three employees and exfiltrated data from them.

7 key trends defining the cybersecurity market today

www.csoonline.com · 2 months ago

AI is having a seismic impact on the cybersecurity market. Record-shattering amounts of venture capital is flowing into a new generation of startups focused on AI cybersecurity. At the same time, established cybersecurity vendors are racing to integrate AI and agentic AI features into their platforms, triggering a surge in acquisition activity.

Claude Opus 5 Most Resistant to Indirect Prompt Injection Attacks, With Just 2% Success Rate

gbhackers.com · 2 months ago

Anthropic’s Claude Opus 5 has significantly reduced the likelihood of a successful indirect prompt injection (IPI) attack, bringing it down to 2% over 15 attempts in the Gray Swan IPI benchmark. This marks an improvement from a 5.5% success rate observed with Claude Opus 4.8.

Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

thehackernews.com · 2 months ago

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro ("solidity-pro") that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.

North Korean Hackers Explore AI Transcription for Stolen Calls and Meetings

gbhackers.com · 2 months ago

North Korea-linked Kimsuky operators are expanding their artificial intelligence capabilities, with newly observed evidence showing experimentation with local large language models. Retrieval-augmented generation, AI agents, and speech-to-text tooling that could accelerate analysis of stolen calls, meetings, and documents.

Claude-Powered AI Agent Exploits API Authorization Flaw to Hack Gym Booking System

gbhackers.com · 2 months ago

An Australian AI agent powered by Anthropic’s Claude reportedly exploited an authorization flaw in a gym booking platform, allowing it to book classes outside of permitted time frames and cancel another user’s waitlist reservation without explicit permission.

Payroll Pirates Abuse Microsoft Graph to Find HR and Finance Staff After Account Compromise

gbhackers.com · 2 months ago

A widespread phishing operation that compromises Microsoft 365 accounts through adversary-in-the-middle (AiTM) infrastructure, then uses Microsoft Graph to identify employees handling payroll, finance, HR, benefits, invoices, and banking workflows. The activity closely overlaps with Microsoft’s “Payroll Pirates” cluster, tracked as Storm-2755.

OpenAI's Next AI Model Astra Shows Cyber Performance Strong Enough to Trigger Pause

thehackernews.com · 2 months ago

OpenAI has announced that it's pausing some "internal activities" involving its upcoming artificial intelligence (AI) model Astra after an internal evaluation found it had made significant advancements in agentic coding and cybersecurity.

Claude Code Child Process Can Read Its Own OAuth Token From macOS Keychain

gbhackers.com · 2 months ago

A macOS Keychain implementation weakness in Anthropic’s Claude Code CLI could allow any process running as the logged-in user including a Claude Code-spawned child process to retrieve the tool’s OAuth credential bundle silently. The issue underscores how trusted AI coding-agent ancestry can mask high-impact credential access and persistence activity on developer endpoints.

Metabase 0-Day Flaw Exploited in Attack to Inject Arbitrary SQL and Steal Database Credentials

gbhackers.com · 2 months ago

Metabase has reported a critical security incident involving a zero-day vulnerability that is actively being exploited. This vulnerability affects self-hosted deployments running version 1.58 and later. According to the company, an attacker exploited this previously unknown flaw to target Metabase Cloud before the vulnerable endpoints were blocked and a patch was developed.

New CSS Bomb Attacks Let Hackers Steal Passwords and Tokens From Webmail Users

gbhackers.com · 2 months ago

Security researcher Gareth Heyes has revealed techniques for webmail attacks that exploit HTML and CSS, the technologies used to format emails, to manipulate user interfaces, leak authentication data, and in some cases, capture passwords. Webmail services need to display HTML controlled by the sender without compromising the security of the mailbox application.

Levi Strauss Hit by Cyberattack, Hackers Use Social Engineering to Steal Corporate Data

gbhackers.com · 2 months ago

Levi Strauss & Co. has reported a cybersecurity incident in which an unauthorized third party used social engineering techniques to compromise three employee-issued computers and exfiltrate unspecified corporate information. According to the apparel maker, the intrusion was contained, with no evidence that consumer data was affected or that business operations were disrupted.

Critical Flaws Discovered in Belgian eID Software Used by 2 Million People

www.securityweek.com · 2 months ago

The vulnerabilities affected software used by eight of Belgium’s ten largest banks and over 60 government agencies.

The Best Intrusion Detection & Prevention (IDS/IPS) Tools, Compared and Priced (2026)

gbhackers.com · 2 months ago

This market runs from $0 to seven figures, and the free options power half the paid ones, so price comparisons here reward honesty.

Cybersecurity Newsletter Weekly – Top 50 Biggest Cybersecurity Stories – $70M Bitcoin Heist,Google Passkey Theft, Copilot CEO Fraud,Chrome 151 & Claude Exploits & More

gbhackers.com · 2 months ago

Welcome to this week’s edition of the GBHackers cybersecurity newsletter, your weekly cybersecurity bulletin covering the 50 most important stories from August 3, 7, 2026.

Finally, something useful from Google regarding search hijacking

www.ghacks.net · 2 months ago

The number of extensions I’m finding and reporting that silently override users’ search engines is honestly crazy. https://malext.io/?q=SearchJack Hopefully Google’s upcoming Chrome protection against extensions that hijack the default search engine and New Tab page will put a serious dent in this.

DEFCON: New Red Team Tactic

doctoreww.github.io · 2 months ago

Evil Fonts deceive a viewer by rendering a different letter than is actually on the disk. Evil Fonts can poison HTML, DOCX, PDFs, and anywhere else you can bring your own fonts. Works great in Windows corporate networks for bypassing security tooling, initial access through JavaScript free click fix (beats mitm web security tooling), and leaving traps around the network to harvest shells.

Pentagon presses defense firms to build weapons as Iran war depletes stocks

www.washingtonpost.com · 2 months ago

The directive to industry from Deputy Defense Secretary Steve Feinberg comes amid tensions over a critical U.S. munitions shortage.

Analyzing a Multi-Stage PowerShell Payload Chain

malwr-analysis.com · 2 months ago

I recently analyzed a multi-stage PowerShell payload delivery chain involving heavily obfuscated PowerShell loaders and remotely hosted payloads. The analysis covers PowerShell deobfuscation, hidden execution, Base64/XOR decoding, a decoy “Verification complete!” prompt, payload delivery, and IOCs. Initial indicators: 203[.]188[.]171[.]166 dorenzaa[.

Hackers breach TrueConf to trojanize client installers with backdoors

www.bleepingcomputer.com · 2 months ago

The Head Mare hacktivist group has been exploiting vulnerabilities in unpatched TrueConf video conferencing servers to replace client installers with malicious versions that deliver backdoors.

DEF CON talk: 8 in 10 Banks in Belgium HATE This One Weird eID RCE

amibeingpwned.com · 2 months ago

Hey everyone, I'm OP here so feel free to ask questions

Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data

www.securityweek.com · 2 months ago

The RovoBlast attack method identified by Varonis researchers could have been exploited to steal Confluence, Jira and SharePoint data.

Write Once, Shell Everywhere - Turning Arbitrary File Writes into RCE (DEF CON Bug Bounty Village)

ethiack.com · 2 months ago

Write once, shell everywhere. Sun Microsystems didn't mean it like this. Talk from today at DEF CON's Bug Bounty Village. Full technique catalog graded for distroless containers, an errno path oracle for black-box target fingerprinting, and three minimal-guessing techniques: bash fd/255, Rails schemacache.yml deserialization, and a Node.js worker path overwrite without process restart.

New Amazon Data Center Is Set to Have the Most Polluting Power Plant in the U.S.

www.nytimes.com · 2 months ago

The tech giant is investing in the natural-gas-burning power plant as part of a huge data center in Texas, even as it pledges to honor climate commitments.

Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers

thehackernews.com · 2 months ago

Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outside server. Two security firms found that behavior independently, by different routes. Only one of those routes is confirmed closed. PromptArmor, an AI security firm, hid the instructions in content Rovo reads.

WordPress XSS2Shell Flaw Enables Attackers to Achieve Remote Code Execution

gbhackers.com · 2 months ago

WordPress has patched a high-severity vulnerability, tracked as CVE-2026-64638 and nicknamed XSS2Shell, that begins as an unauthenticated cross-site scripting bug on the login screen and can be chained into full remote code execution. Researchers at pwn.ai discovered the flaw, which carries a CVSS score of 8.

Bugtraq Is Back: The Original Full Disclosure Mailing List Is Live Again

gbhackers.com · 2 months ago

Sophia Antipolis, France, August 7th, 2026, CyberNewswire At DEF CON 34 in Las Vegas, security researcher Jonathan Brossard, known in the community as endrazine, announced the rebirth of the original Bugtraq mailing list. Established in 1993, Bugtraq is the original mailing list where cybersecurity vulnerabilities, mitigations, and cutting-edge techniques have been discussed at scale.

New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

thehackernews.com · 2 months ago

New research shows content inside an email can escape its message boundary and interfere with the webmail interface. Across attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the techniques can capture passwords, take over third-party accounts, leak tokens, hijack trusted UI actions, and manipulate AI tools that read email.

18-Year-Old Linux Kernel SCTP Vulnerability Lets Attackers Gain Root and Escape Containers

gbhackers.com · 2 months ago

SCTPhantom, tracked as CVE-2026-64564, is a high-severity Linux kernel use-after-free vulnerability in the Stream Control Transmission Protocol (SCTP) Dynamic Address Reconfiguration implementation.

Fake Zoom Installer Uses .NET Downloader to Deploy Overlord RAT on macOS

gbhackers.com · 2 months ago

A cross-platform malware campaign that disguises itself as a legitimate Zoom installer to deploy Overlord, an open-source remote access trojan (RAT), on both macOS and Windows machines.

Critical macOS RCE Vulnerability Allows Attackers to Gain Root Access Without Password

gbhackers.com · 2 months ago

Apple has shipped emergency macOS updates to close a critical vulnerability in Screen Sharing, tracked as CVE-2026-65400, which allows unauthenticated remote attackers to execute arbitrary code and access files with root-level privileges. The flaw is especially severe on systems where Screen Sharing is exposed to the public internet. Apple’s August 6 releases macOS Tahoe 26.6.

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

thehackernews.com · 2 months ago

Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.

Russian Hackers Use AI Slopsquatting to Publish 700+ Malicious npm Packages

gbhackers.com · 2 months ago

A large-scale supply chain attack has hit the npm registry, with a suspected Russian threat actor publishing more than 700 malicious packages in just 48 hours. Researcher Paul McCarty documented the campaign, tracked as WEL1DROPPER, and the package count has since grown past 1,000.

N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist

thehackernews.com · 2 months ago

N-able has released a fresh round of hotfixes for N‑central as part of its investigation into ongoing exploitation of a recently disclosed security flaw in the Remote Monitoring and Management (RMM) product. "We are proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques," the company said.

Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts

thehackernews.com · 2 months ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical-severity security flaw impacting Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. The vulnerability, tracked as CVE-2026-8037 (CVSS score: 9.

Storm-1175 Launches StormEncryptor Ransomware Attacks Using N-able Security Flaw

gbhackers.com · 2 months ago

Microsoft Threat Intelligence has identified a new ransomware campaign attributed to the financially motivated threat actor Storm-1175 that began deploying a previously undocumented ransomware strain, StormEncryptor, on August 2, 2026. The activity represents Storm-1175’s first observed operation since April 2026 and signals a notable shift in its ransomware tooling.

SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free · Tencent Zhuque Lab

matrix.tencent.com · 2 months ago

Yes, given that the legacy SCT protocol has known security vulnerabilities such as sctphantom, the industry strongly recommends deprecating it and migrating to more secure modern standards to ensure system security.

Inside the Modern SOC: The Identity Front Door

unit42.paloaltonetworks.com · 2 months ago

Identity-based attacks drive 90% of incidents. Learn how modern attackers exploit identities and what SOC leaders can do to respond.

Friday Squid Blogging: Arctic Bobtail Squid Video

www.schneier.com · 2 months ago

Nice video of the Arctic bobtail squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

Metabase SQLi zero-day exploited in customer data-theft attacks

www.bleepingcomputer.com · 2 months ago

A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework and Tally.

Unlimited Technology Systems breach impacts 3.8 million people

www.bleepingcomputer.com · 2 months ago

Healthcare software company Unlimited Technology Systems reported that more than 3.8 million people were impacted by a data breach incident that occurred in October 2025.

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

thehackernews.com · 2 months ago

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems.

ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets

thehackernews.com · 2 months ago

ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script that profiles the host and then fetches a macOS malware payload that's compatible with the computer's CPU architecture. "

Meta Ordered to Pay $567M and Overhaul Teen Safety on Facebook, Instagram

www.techrepublic.com · 2 months ago

Meta must pay $567 million and change Facebook and Instagram protections for minors under a New Mexico court order it plans to appeal.

tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open

bobdahacker.com · 2 months ago

The meetings collection has no tenant isolation. Any authenticated tl;dv user can query every meeting across every account on the platform. Each meeting record hands you the creator's email address, the conference ID (which is a joinable Google Meet or Teams room), the provider, the recording status, and timestamps.

Samsung’s August Update Patches 56 Security Vulnerabilities Across Galaxy Devices

www.techrepublic.com · 2 months ago

Samsung’s August 2026 Galaxy update fixes 56 Android and One UI security flaws, including critical vulnerabilities and clipboard access risks.

UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

thehackernews.com · 2 months ago

A recent wave of cyber attacks targeting financial services, private equity, and professional services is attributed to a data extortion group known as UNC6671. "UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT help desk staff facilitating mandatory, urgent security migrations.

Trojanized AI skills gain 1.7M installs in agent-targeted attack

www.csoonline.com · 2 months ago

Researchers have uncovered an extremely effective attack campaign that involved AI agent skills trojanized to deploy a credential stealer. The incident is part of a growing trend in which attackers are targeting the AI software supply chain by poisoning sharable instruction and configuration files for agentic tools.

AI-Generated Patches Fail Half the Time

www.darkreading.com · 2 months ago

A study of more than 6,000 patches found that even working patches can introduce new bugs, break something else, or are open to bypass.