Blahalla

Fake Moustache Fools Age Checks, Sparks Online Safety Act Fears

gbhackers.com · 2 months ago

Age verification systems intended to protect children online are proving easily circumvented. Children are bypassing safeguards with simple techniques, including drawing fake facial hair to appear older during camera-based age checks. While the Online Safety Act aims to limit harmful content and improve reporting, many children still encounter inappropriate material, and privacy concerns are rising due to data collection during age verification processes. Experts warn that a more robust and privacy-preserving approach is needed to balance child safety and user privacy.

Trellix Investigates RansomHouse Breach Claims Involving Source Code Repository

gbhackers.com · 2 months ago

Trellix is investigating a potential security incident after the RansomHouse extortion group claimed responsibility for a cyberattack. RansomHouse added Trellix to its list of victims on the dark web, alleging they accessed a portion of Trellix’s internal source code repository. Trellix confirms unauthorized access but states its core operations, customer-facing software, and source code distribution processes remain secure and there’s no evidence of exploitation. The company is working with forensic experts and law enforcement and will share additional details as the investigation continues.

Pen tests show AI security flaws far more severe than legacy software bugs

www.csoonline.com · 2 months ago

Penetration testing reveals AI systems have a significantly higher rate of severe vulnerabilities compared to traditional applications, with 32% of AI and LLM findings rated as high risk. A key factor is the rapid deployment of AI without mature security controls, leading to issues like prompt injection, which has seen a surge in reports. Remediation rates for these high-risk AI vulnerabilities are also low, at just 38%, partly due to fragmented ownership across multiple teams, and a lack of established fix procedures. Experts recommend treating AI systems as production environments with robust security measures.

Your refresh plan has a CVE blind spot

www.csoonline.com · 2 months ago

Organizations are facing challenges with aging server infrastructure, especially due to past supply chain disruptions. Simply replacing equipment based on age is insufficient, as it doesn't account for actual security risks. A risk-based assessment, involving inventorying assets, mapping CVEs, and scoring based on factors like exploitation status and data sensitivity, is crucial. This approach prioritizes remediation, informs risk acceptance documentation, and creates a defensible refresh sequence, moving beyond age-based replacement schedules. Tools like Nessus, Qualys, Rapid7, Greenbone OpenVAS, Nmap, and runZero can aid in inventory and vulnerability identification.

She had four kids with Elon Musk. Now she’s central to his courtroom fight.

www.washingtonpost.com · 2 months ago

false

Critical Vulnerability in Rancher Fleet Enables Full Cluster-Admin Privileges

gbhackers.com · 2 months ago

A critical vulnerability, CVE-2026-41050, has been identified in Rancher Fleet, a Kubernetes management tool. This flaw breaks the platform’s multi-tenant isolation, allowing attackers to potentially steal sensitive data and escalate privileges to full cluster-admin status. The vulnerability stems from improper handling of ServiceAccount impersonation during deployment pipelines and allows attackers to extract admin tokens from Kubernetes namespaces. Affected Rancher Fleet versions include those before 0.11.13, 0.12.14, 0.13.10, and 0.14.5, while Rancher versions 2.10.11 and older also require a Fleet upgrade. Security teams are advised to disable vulnerable repositories, audit Git repositories, rotate any compromised secrets, and enable strict audit logging.

Former govt contractor convicted for wiping dozens of federal databases

www.bleepingcomputer.com · 2 months ago

A former government contractor in Virginia has been convicted of conspiring to destroy dozens of federal databases after being terminated from his job. The individual, along with his brother, allegedly wiped roughly 96 government databases in February 2025, deleting sensitive investigative documents and Freedom of Information Act records. Following the data deletion, they reportedly attempted to cover their tracks by seeking advice from an artificial intelligence assistant and destroying evidence. The contractor faces a maximum of 21 years in prison, while his brother faces a potential sentence of 45 years.

Hackers Use Morse Code to Trick Grok and Bankrbot, Steal $200K in Crypto Tokens

gbhackers.com · 2 months ago

Hackers successfully exploited vulnerabilities in artificial intelligence agents, resulting in approximately $200,000 in cryptocurrency theft. The attacker tricked the Grok AI model and Bankrbot wallet agent by using Morse code to bypass security filters and authorize a large token transfer on the Base network. The attacker initially gained elevated permissions by gifting a special NFT to Grok's wallet, then leveraged the AI’s translation of the Morse code command to trigger the unauthorized transfer of 3 billion DRB tokens. Following the incident, the stolen funds were partially returned to Grok’s wallet in the form of Ethereum and USD Coin.

New Linux PamDOORa Backdoor Uses PAM Modules to Steal SSH Credentials

thehackernews.com · 2 months ago

Researchers have identified a new Linux backdoor called PamDOORa, which is being offered for sale on a Russian cybercrime forum. This backdoor leverages the Pluggable Authentication Module framework to enable persistent SSH access and steal credentials from legitimate users. The tool includes anti-forensic capabilities to erase traces of malicious activity, and it is advertised as an evolution of existing open-source PAM backdoors. Threat actors are now selling PamDOORa for $900, a significant price reduction from its initial asking price.

‘PCPJack’ Worm Removes TeamPCP Infections, Steals Credentials

www.securityweek.com · 2 months ago

A new malware framework called PCPJack has emerged, targeting environments previously infected by the TeamPCP hacking group. This framework removes TeamPCP tools and installs its own malicious components, which steal credentials from multiple cloud environments. PCPJack seeks.env files, SSH keys, cryptocurrency wallets, and credentials for services like AWS, Slack, and WordPress, suggesting motives of spam campaigns, financial fraud, and extortion. The framework exploits vulnerabilities like CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, and CVE-2025-48703, and uses Telegram for command and control.

Signed Logitech Installer Abused to Drop TCLBANKER Banking Trojan

gbhackers.com · 2 months ago

Hackers are using a signed Logitech installer to distribute the TCLBANKER banking trojan, targeting Brazilian users. The malware, an evolution of MAVERICK/SORVEPOTEL, monitors 59 financial websites and allows attackers to control victims’ sessions for social engineering. TCLBANKER employs several evasion techniques, including DLL sideloading, anti-debugging measures, and environment-gated payload decryption, making analysis difficult. It also includes modules for spreading via WhatsApp and Outlook, sending phishing messages and emails.

Ransomware Group Takes Credit for Trellix Hack

www.securityweek.com · 2 months ago

The RansomHouse ransomware group has claimed responsibility for a data breach at cybersecurity firm Trellix. Trellix confirmed a portion of its source code repository was breached but stated its release and exploitation processes were not affected. The hackers have posted screenshots indicating access to internal services, but the type of data stolen remains unspecified. RansomHouse, a ransomware-as-a-service provider operating since 2022, currently lists over 170 victims on its leak website.

423 Firefox Flaws Fixed as Browser Gains Support for Claude, Mythos, and More

gbhackers.com · 2 months ago

Mozilla has resolved 423 security vulnerabilities in Firefox, utilizing advanced artificial intelligence models like Claude Opus 4.6 and Claude Mythos Preview. The new AI-assisted system integrates agentic AI into existing fuzzing infrastructure, enabling the discovery of deeply hidden legacy issues and complex vulnerabilities such as sandbox escapes and Use-After-Free conditions. The system uncovered a 15-year-old flaw in the HTML legend element, a 20-year-old XSLT vulnerability, and a bypass of clamping in HTML tables. The updates include versions 149.0.2, 150.0.1, and 150.0.2, and Mozilla encourages other software projects to adopt similar AI-driven security methods.

New Linux 'Dirty Frag' zero-day gives root on all major distros

www.bleepingcomputer.com · 2 months ago

A newly discovered Linux zero-day vulnerability, called Dirty Frag, allows attackers to gain root privileges on major distributions with a single command. The vulnerability chains together two kernel flaws, introduced roughly nine years ago, to modify protected system files. Currently, no CVE has been assigned to Dirty Frag, and affected distributions include Ubuntu, Red Hat Enterprise Linux, and Fedora. Users can temporarily mitigate the vulnerability by removing specific kernel modules using a command-line instruction.

New Infostealer Campaign Abuses GitHub Releases to Hide Malware Payloads

gbhackers.com · 2 months ago

A new cyberespionage campaign is targeting Russian-speaking individuals and organizations through phishing emails disguised as humanitarian aid requests. The attack uses a malicious shortcut file that downloads and executes a Python-based infostealer, which establishes a persistent presence on compromised systems. The malware steals credentials, captures keystrokes and screenshots, and can even hijack Telegram accounts, using a GitHub account to distribute malicious components and blend them with legitimate software. The C2 server is located at 159.198.41[.]140 and the malware is protected with PyArmor v9.2 Pro.

Vulnerability in Claude Extension for Chrome Exposes AI Agent to Takeover

www.securityweek.com · 2 months ago

A security flaw called ClaudeBleed exists in the Claude extension for Chrome, enabling attackers to potentially take control of the AI agent. The vulnerability arises from the extension's trust in the origin of commands rather than the execution context, allowing unauthorized extensions to issue commands. Attackers can bypass security protections and forge user approvals to manipulate the AI agent, potentially leading to data theft from services like Gmail, GitHub, and Google Drive. Anthropic has released a partial fix, but the root cause remains unaddressed, allowing attackers to bypass the protection by switching to privileged mode.

PCPJack Worm Targets Docker, Kubernetes, Redis, and MongoDB Credentials

gbhackers.com · 2 months ago

A new malware framework called PCPJack is targeting exposed cloud and container infrastructure to steal credentials, seemingly to displace the TeamPCP threat actor. The malware uses a Linux shell script to deploy a Python-based framework that harvests credentials from various locations, including Docker secrets and Kubernetes tokens. PCPJack utilizes Common Crawl data to identify potential targets and exploits vulnerabilities like CVE-2025-55182 in React and Next.js deployments for lateral movement. The framework employs Telegram for command and control and exhibits a focus on fraud, spam, and extortion.

Ivanti Patches EPMM Zero-Day Exploited in Targeted Attacks

www.securityweek.com · 2 months ago

Ivanti has released security updates for its Endpoint Manager Mobile product to address five vulnerabilities, including a zero-day being actively exploited. The vulnerability, CVE-2026-6973, allows for remote code execution and has been used in targeted attacks against a limited number of customers. It’s suspected that CVE-2026-6973 may be related to CVE-2026-1281 and CVE-2026-1340, which were also exploited in previous attacks, and CISA has added CVE-2026-6973 to its Known Exploited Vulnerabilities catalog. Chinese threat actors are believed to be behind some of these attacks.

PoC Exploit Released for Dirty Frag Linux Kernel Vulnerability

gbhackers.com · 2 months ago

A new Linux kernel vulnerability class called "Dirty Frag" allows attackers to reliably gain root access across multiple major Linux distributions. The vulnerability exploits two flaws: an xfrm-ESP Page-Cache Write, present since 2017, and an RxRPC Page-Cache Write introduced in June 2023. By chaining these flaws, attackers can manipulate system memory and bypass authentication, impacting systems like Ubuntu, RHEL, openSUSE, CentOS Stream, AlmaLinux, and Fedora. Because the responsible disclosure was broken, no CVE identifiers have been assigned and patches are not yet available; administrators are advised to block the esp4, esp6, and rxrpc kernel modules as an immediate mitigation.

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions

thehackernews.com · 2 months ago

A new local privilege escalation vulnerability, dubbed "Dirty Frag," is impacting numerous Linux distributions. The flaw, reported April 30, 2026, allows an unprivileged user to gain root access by chaining vulnerabilities in the xfrm-ESP Page-Cache Write and RxRPC Page-Cache Write subsystems. Affected distributions include Ubuntu, RHEL, openSUSE, CentOS Stream, AlmaLinux, and Fedora. A working proof-of-concept is available, and users are advised to blocklist specific kernel modules as a temporary mitigation; the vulnerability is not mitigated by existing Copy Fail defenses. CVEs mentioned are CVE-2026-31431, CVE-2022-27666.

NWHStealer Campaign Deploys Bun Loader, Anti-VM Evasion, and Encrypted C2

gbhackers.com · 2 months ago

Cybercriminals are now using the Bun JavaScript runtime to distribute the NWHStealer infostealer, taking advantage of its newness and high performance to evade detection. The malware is delivered through malicious ZIP archives disguised as legitimate software, employing a dual-loader system for redundancy. It utilizes anti-virtualization techniques and encrypted communication with a command-and-control server at silent-harvester.cc to steal data like browser information, cryptocurrency wallets, and application credentials. Security experts advise users to download software from trusted sources and use browser protection tools.

Multiple Critical Flaws Fixed in Next.js and React Server Components

gbhackers.com · 2 months ago

Vercel has released Next.js version 16.2.6 to address numerous security vulnerabilities impacting web applications. These flaws include bypasses of middleware and proxy protections, denial-of-service conditions related to Server and Cache Components, and server-side request forgery. Patches were also applied for cross-site scripting vulnerabilities and cache poisoning risks. Developers are strongly encouraged to update immediately and review security advisories to mitigate potential exploitation.

Canvas Breach Disrupts Schools & Colleges Nationwide

krebsonsecurity.com · 2 months ago

A cybercrime group, ShinyHunters, has launched a data extortion attack against Canvas, a widely-used education technology platform, impacting schools and universities nationwide. The group claims to have stolen data from 275 million students and faculty and defaced the login page to demand a ransom, initially set at May 6 and later extended to May 12. Compromised data includes names, email addresses, and student ID numbers, though sensitive information like passwords was not found. Instructure has taken Canvas offline and is investigating, while some universities are reportedly considering paying a ransom to prevent data release. ShinyHunters has been linked to previous breaches, including a 2025 incident at the University of Pennsylvania, and recently targeted ADT.

Palo Alto Networks firewall flaw has been exploited for several weeks

www.csoonline.com · 2 months ago

A critical vulnerability, CVE-2026-0300, affects Palo Alto Networks firewalls running PAN-OS versions 10.2, 11.1, and 12.1. The flaw allows unauthenticated attackers to execute code with root privileges on exposed firewalls using the User-ID Authentication Portal. Limited exploitation has been observed targeting portals accessible from the public internet, and the US Cybersecurity and Infrastructure Security Agency has added the vulnerability to its known exploited vulnerabilities catalog. Palo Alto Networks advises restricting access to the portal and disabling unnecessary features as mitigations while patches are prepared.

Palo Alto Networks firewall flaw has been exploited for several weeks

www.csoonline.com · 2 months ago

A critical zero-day vulnerability, CVE-2026-0300, has been identified in Palo Alto Networks PAN-OS firewalls. Attackers, believed to be state-sponsored hackers, have exploited the flaw in the User-ID Authentication Portal to execute code with root privileges. More than 5,400 PAN-OS VM firewalls are currently exposed online, primarily in Asia and North America. Palo Alto Networks is preparing security updates expected to be released May 13, and advises customers to restrict access or disable the Authentication Portal until then.

Become a millionaire by bug hunting on Android

www.csoonline.com · 2 months ago

Google is increasing the maximum reward for serious Android vulnerabilities to one point five million dollars. The highest reward for vulnerabilities in Google Chrome is now two hundred fifty thousand dollars. Google has distributed eighty one point six million dollars in rewards through its bug bounty programs since they began in 2010. These programs incentivize security researchers to find and report vulnerabilities.

13 new critical holes in JavaScript sandbox allow execution of arbitrary code

www.csoonline.com · 2 months ago

Thirteen critical vulnerabilities have been discovered in the vm2 JavaScript sandbox package, potentially allowing attackers to execute arbitrary code. The most severe, CVE-2026-26956, involves a full sandbox escape confirmed on Node.js 25.6.1 with WebAssembly support. Another vulnerability, CVE-2026-44007, stems from improper access control and affects how the nesting option interacts with the legacy module resolver. Developers are urged to immediately upgrade to version 3.11.2 to address these issues and consider alternative isolation methods like Docker containers or V8 Isolates.

Canvas login portals hacked in mass ShinyHunters extortion campaign

www.bleepingcomputer.com · 2 months ago

The cybercriminal group ShinyHunters has once again targeted Instructure, defacing Canvas login portals for approximately 330 educational institutions. The defacement displayed a message threatening to leak stolen data unless a ransom is paid, with a deadline of May 12, 2026. This incident follows a previous breach where ShinyHunters allegedly stole 280 million student and staff records. Instructure has taken Canvas offline to address the vulnerability and is reportedly unresponsive to inquiries regarding the data breach.

New TCLBanker malware self-spreads over WhatsApp and Outlook

www.bleepingcomputer.com · 2 months ago

A new banking trojan called TCLBanker has emerged, targeting 59 banking, fintech, and cryptocurrency platforms. It spreads through compromised MSI installers and utilizes self-spreading worm modules for WhatsApp and Outlook, automatically infecting new victims. The malware employs techniques to evade analysis and includes capabilities like live screen streaming, keylogging, and overlay systems for fraudulent credential prompts. Researchers believe TCLBanker is an evolution of the Maverick/Sorvepotel malware family, and its targeting may expand beyond Brazil.

Kernel LPE Vulnerability Published Early Due To Third-Party Breaking Embargo

lwn.net · 2 months ago

A new local-privilege-escalation vulnerability, dubbed Dirty Frag, has been publicly released. This flaw allows for immediate root privilege escalation on all major Linux distributions, similar to a recently disclosed Copy Fail vulnerability. The discoverer, Hyunwoo Kim, released exploit code and a removal script, despite an intended coordinated disclosure. Because the embargo has been broken, no patches or CVEs currently exist.

Ollama vulnerability highlights danger of AI frameworks with unrestricted access

www.csoonline.com · 2 months ago

A critical vulnerability, CVE-2026-7482, has been discovered in the popular AI framework Ollama, potentially exposing sensitive data from over 300,000 internet-facing servers. The flaw allows unauthenticated attackers to trigger a memory leak by uploading a specially crafted file, revealing data like user prompts, API keys, and proprietary code. Researchers recommend updating to version 0.17.1, implementing authentication, and restricting network access to mitigate the risk. Companies should also audit networks for unauthorized AI frameworks to prevent similar security incidents.

After Replacing TeamPCP Malware, 'PCPJack' Steals Cloud Secrets

www.darkreading.com · 2 months ago

Researchers have identified a new modular cloud worm called PCPJack, designed to remove TeamPCP malware while simultaneously stealing sensitive information. PCPJack scans for and eliminates TeamPCP processes, then collects credentials and keys from cloud services, email providers, cryptocurrency wallets, and various applications like AWS and Slack. Notably, it uses Common Crawl data and parquet files to identify and exploit potential targets, a unique approach in cloud cybercrime, and does not include cryptomining functionality. The origin of PCPJack is speculated to be a former TeamPCP member, possibly due to its specific targeting of TeamPCP’s tools.

LinkedIn illegally blocking free accounts from seeing ‘who’s viewed your profile’ data, group alleges

www.csoonline.com · 2 months ago

A digital rights group, None of Your Business, has filed a legal complaint in Austria alleging LinkedIn is violating the General Data Protection Regulation, or GDPR. The complaint states LinkedIn unfairly restricts access to ‘Who’s Viewed Your Profile’ data to paying subscribers while denying it to free users in the EU. The group argues this policy contradicts GDPR Article 15, which guarantees users the right to access their personal data. LinkedIn maintains it complies with GDPR and provides the information through its privacy policy, but a ruling in favor of NOYB could force LinkedIn to make the feature free or alter its data-sharing practices.

When prompts become shells: RCE vulnerabilities in AI agent frameworks

www.microsoft.com · 2 months ago

Microsoft's Security Research team recently addressed critical remote code execution vulnerabilities in the Semantic Kernel AI agent framework. Two critical vulnerabilities, CVE-2026-25592 and CVE-2026-26030, were discovered, which allowed attackers to execute arbitrary code through prompt injection without malicious attachments. One vulnerability involved an improperly exposed tool enabling file writes to the host system, requiring upgrades to version 1.71.0 or higher. Microsoft recommends upgrading Semantic Kernel, treating AI model parameters as attacker-controlled, and recognizing that AI models are not security boundaries.

Dirty Frag - Linux LPE similiar to Copy Fail

vuink.com · 2 months ago

A new vulnerability class called Dirty Frag has been identified, allowing for potential root privilege escalation on Linux systems. The vulnerability chains together two separate page-cache write flaws. It is a deterministic bug, meaning a high success rate is expected without a timing dependency, and the kernel will not panic on failure. Due to a premature public disclosure, no patch or CVE is currently available.

Worries About AI’s Risks to Humanity Loom Over the Trial Pitting Musk Against OpenAI’s Leaders

www.securityweek.com · 2 months ago

false

Has CISA Finally Found Its New Leader in Tom Parker?

www.darkreading.com · 2 months ago

false

New PCPJack worm steals credentials, cleans TeamPCP infections

www.bleepingcomputer.com · 2 months ago

A new malware framework called PCPJack is targeting cloud infrastructure to steal credentials and remove infections from the TeamPCP threat group. The framework scans for exposed services like Docker, Kubernetes, Redis, and MongoDB, exploiting vulnerabilities such as CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, and CVE-2025-48703 to gain access. Stolen credentials are encrypted and exfiltrated to Telegram channels, and the malware establishes persistence using various methods, including systemd services. Researchers believe PCPJack may be operated by a former TeamPCP affiliate and recommend implementing multi-factor authentication and following least-privilege principles to mitigate the risk.

Australia warns of ClickFix attacks pushing Vidar Stealer malware

www.bleepingcomputer.com · 2 months ago

Australian organizations are facing a malware campaign utilizing a social engineering technique called ClickFix to distribute the Vidar Stealer malware. This technique tricks users into running malicious PowerShell commands through fake verification prompts on compromised websites, often targeting WordPress infrastructure. Vidar Stealer steals sensitive information like passwords, cryptocurrency wallets, and system details, and attempts to minimize forensic traces. The Australian Cyber Security Center advises restricting PowerShell execution, updating WordPress sites, and reviewing indicators of compromise.

Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access

thehackernews.com · 2 months ago

Ivanti is reporting active exploitation of a critical vulnerability, CVE-2026-6973, in its Endpoint Manager Mobile software. This flaw allows authenticated administrators to execute remote code and has already impacted a limited number of customers. The U.S. Cybersecurity and Infrastructure Security Agency has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating fixes for Federal agencies. Several other vulnerabilities have also been patched: CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821.

PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud Systems

thehackernews.com · 2 months ago

Security researchers have identified a new credential theft framework called PCPJack, which targets exposed cloud infrastructure and removes traces of a related group, TeamPCP. The tool harvests credentials from various cloud services, including Docker, Kubernetes, and Redis, then exfiltrates data to attacker-controlled servers. PCPJack spreads like a worm, utilizing exploits for CVE-2025-55182, CVE-2025-29927, CVE-2026-1357, CVE-2025-9501, and CVE-2025-48703, and it monitors whether TeamPCP has been removed from compromised systems. The campaign appears focused on illicit revenue generation through credential theft and resale, but notably lacks cryptocurrency mining capabilities.

Honey Tokens: Bait Credentials That Catch Breaches

infisical.com · 2 months ago

Rippling recently detected corporate espionage after an employee repeatedly searched for competitor information in Slack, leading them to create a honeypot, a deceptive resource designed to trap attackers. Honey tokens are fake credentials, like AWS IAM access keys, placed among real secrets to alert organizations when they are accessed, indicating a breach. Infisical is now offering honey tokens that function by generating CloudTrail logs when used, triggering immediate alerts and requiring adjacent secrets to be rotated. These tokens are deployed within an organization’s AWS account to avoid detection by attackers who can identify tokens from vendor-controlled infrastructure.

CVE-2026-42511 Breakdown: RCE in FreeBSD

aisle.com · 2 months ago

A critical Remote Code Execution vulnerability, CVE-2026-42511, has been identified in FreeBSD’s dhclient software, potentially impacting devices from 2005 onward. Attackers can exploit the vulnerability by injecting malicious code through a DHCP server, gaining root access to affected systems. The vulnerability stems from improper data handling, causing the execution of shell commands with root privileges. A fix is available, but the discovery emphasizes the importance of securing network configuration processes.

World Passkey Day: Advancing passwordless authentication

www.microsoft.com · 2 months ago

false

Palo Alto Zero-Day Exploited in Campaign Bearing Hallmarks of Chinese State Hacking

www.securityweek.com · 2 months ago

A zero-day vulnerability, CVE-2026-0300, is being exploited in Palo Alto Networks firewalls. The flaw allows for unauthenticated remote code execution with root privileges and has been linked to a likely state-sponsored threat group, CL-STA-1132. Attackers have been observed using tools like Earthworm and ReverseSocks5 to establish covert communication channels and bypass firewalls, along with techniques like Active Directory enumeration and log deletion. Evidence suggests the attacks originate from China, based on the tools and tactics employed.

Ivanti warns of new EPMM flaw exploited in zero-day attacks

www.bleepingcomputer.com · 2 months ago

Ivanti has warned customers about a high-severity remote code execution vulnerability, CVE-2026-6973, in Endpoint Manager Mobile (EPMM) that is currently being exploited. This flaw allows attackers with administrative privileges to execute code on vulnerable systems running EPMM versions 12.8.0.0 and earlier. Mitigations are available in versions 12.6.1.1, 12.7.0.1, and 12.8.0.1. Additionally, Ivanti has patched four other high-severity vulnerabilities: CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821, as well as previously disclosed CVE-2026-1281 and CVE-2026-1340.

Bypassing Bitlocker under 5 min using downgrade attack on CVE-2025-48804

www.intrinsec.com · 2 months ago

Microsoft addressed a BitLocker vulnerability, CVE-2025-48804, in July 2025, through a boot manager patch. However, the Secure Boot feature doesn’t verify the version of the boot manager, allowing attackers to exploit older, vulnerable versions signed with the PCA 2011 certificate. Attackers can leverage physical access, a modified BCD file, and a USB drive to load a malicious WinRE image, decrypting the BitLocker volume without triggering alerts. The most reliable protection is enabling a PIN at startup, and Microsoft recommends migrating to the CA 2023 certificate to mitigate the risk.

Claude Code OAuth Tokens Can Be Stolen Through Stealthy MCP Hijacking

www.securityweek.com · 2 months ago

Researchers have discovered a method to stealthily steal OAuth tokens from Claude Code, granting attackers access to connected tools and data. The attack involves modifying the ~/.claude.json file, redirecting traffic through an attacker-controlled proxy, and requires the ability to install a tailored npm package. This redirection allows attackers to intercept tokens during session initiation and refresh, maintaining persistence even with token rotation. Mitiga Labs reported this vulnerability to Anthropic, which deemed it outside their scope due to user consent.

Chrome 148 Rolls Out With 127 Security Fixes

www.securityweek.com · 2 months ago

Google has released Chrome version 148 with 127 security fixes. The update resolves three critical-severity vulnerabilities, including an integer overflow in Blink, CVE-2026-7896, which could lead to memory corruption. Two other critical vulnerabilities are use-after-free issues affecting Mobile and Chromoting components, tracked as CVE-2026-7897 and CVE-2026-7898. Google awarded over 138,000 dollars in bug bounty rewards to external researchers for their contributions.

The Browser Is Breaking Your DLP: How Data Slips Past Modern Controls

www.bleepingcomputer.com · 2 months ago

Traditional data loss prevention, or DLP, solutions are failing to protect sensitive data because modern workflows increasingly occur within web browsers. Users often copy, paste, and upload data directly into applications and AI tools, bypassing endpoint and network controls. This creates a significant visibility gap, as up to 46% of sensitive file uploads go to unsanctioned accounts. Browser-native DLP addresses this by monitoring user activity within browser sessions and providing real-time visibility and control over data movement.