Blahalla

Anthropic’s C.E.O. Says It Could Grow by 80 Times This Year

www.nytimes.com · 2 months ago

false

Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution

unit42.paloaltonetworks.com · 2 months ago

A vulnerability, tracked as CVE-2026-0300, has been identified in Palo Alto Networks PAN-OS software affecting PA-Series and VM-Series firewalls. The flaw allows an unauthenticated attacker to execute arbitrary code with root privileges through the User-ID Authentication Portal. Attackers linked to CL-STA-1132 have exploited this to gain remote code execution, deploying tools like EarthWorm and ReverseSocks5, and subsequently deleting logs to cover their tracks. Palo Alto Networks products, including Advanced WildFire, Next-Generation Firewalls, Advanced URL Filtering and Cortex Xpanse, offer protections, and customers are advised to restrict portal access and consider disabling it if not needed.

Elon Musk’s Confidante Shivon Zilis Is Cast as His Inside Source at OpenAI

www.nytimes.com · 2 months ago

false

Smashing Security podcast #466: Meta sees everything, Copy Fail, and a deepfake gets hired

grahamcluley.com · 2 months ago

There are reports that Meta smart glasses, marketed as privacy controlled by the user, had footage uploaded to human labelers in Nairobi and that 1,108 of those workers were dismissed after blowing the whistle. There is major attention around a newly branded Linux flaw called Copy Fail with its own website and the identifier CVE-2026-31431, though experts are questioning whether the bug is as catastrophic as the marketing suggests. There are demonstrations by Jake Moore of ESET showing he used a deepfake to pass a normal-looking video interview and obtain a job offer for the cloned persona. These stories highlight concerns about privacy, vulnerability hype, and the real world risks posed by deepfakes.

Quacc++: Automated Open Source Vulnerability Discovery

www.somersetrecon.com · 2 months ago

A new open-source tool called Quacc++ automates the process of finding vulnerabilities in public GitHub repositories. It utilizes rapid searching and static analysis to identify potentially vulnerable code and downloads matching repositories for deeper inspection. The tool has successfully identified vulnerabilities, including certificate bypasses, in repositories such as Google DeepMind’s Lab. Quacc++’s rules flag insecure practices such as disabling SSL/TLS certificate verification in various programming languages to prevent man-in-the-middle attacks.

Hackers abuse Google ads for GoDaddy ManageWP login phishing

www.bleepingcomputer.com · 2 months ago

Hackers are using Google ads to conduct a sophisticated phishing campaign targeting ManageWP users, a platform for managing WordPress websites. The attackers employ an adversary-in-the-middle technique, mimicking the real ManageWP login page to steal credentials and two-factor authentication codes. Victims, who often manage hundreds of websites through ManageWP, are being contacted after their data was recovered. The phishing framework appears to be private and includes a Russian-language disclaimer within its code.

VoidStealer Malware Darts Past Google Chrome's Encryption

www.darkreading.com · 2 months ago

Cybersecurity researchers have discovered a new method for bypassing Google Chrome's App-Bound Encryption, a security feature designed to protect sensitive data like cookies. The VoidStealer Trojan utilizes a technique that exploits a brief period when Chrome exposes encryption keys in memory during the login process. By attaching as a debugger, the malware intercepts and extracts these keys, effectively circumventing the intended protections. This latest bypass highlights ongoing vulnerabilities in browsers, which are increasingly targeted due to their role as repositories for sensitive data.

Instructure Breach Exposes Schools' Vendor Dependence

www.darkreading.com · 2 months ago

Instructure, a provider of the Canvas learning management system, recently experienced a data breach where a threat actor, ShinyHunters, claims to have exfiltrated approximately 3.65 terabytes of data impacting around 275 million users across 9,000 institutions. The compromised information includes names, email addresses, student ID numbers, and user messages, though passwords, financial information, and dates of birth were not reportedly stolen. Security experts advise institutions to review data retention policies, limit sensitive discussions on the platform, and strengthen vendor security assessments to mitigate future risks. ShinyHunters has issued a deadline for Instructure to pay a ransom or face data leakage.

Mirai-Based xlabs_v1 Botnet Exploits ADB to Hijack IoT Devices for DDoS Attacks

thehackernews.com · 2 months ago

Researchers have discovered a new Mirai-derived botnet called xlabsv1 that targets devices with exposed Android Debug Bridge, or ADB, services. The botnet, offered as a DDoS-for-hire service, uses 21 flood variants to target game servers and Minecraft hosts. It compromises devices running Android, ARM, MIPS, x86-64, and ARC architectures, often found in Android TV boxes, smart TVs, and IoT hardware. The operator, known as Tadashi, uses a bandwidth-profiling routine to tier pricing for paying customers and employs a "killer" subsystem to eliminate competing botnets.

Critical vm2 sandbox bug lets attackers execute code on hosts

www.bleepingcomputer.com · 2 months ago

A critical vulnerability, CVE-2026-26956, has been identified in the vm2 Node.js sandboxing library, allowing attackers to execute code on the host system. The flaw arises from incorrect exception handling when WebAssembly exception handling and JSTag support are enabled in Node.js 25. Attackers can exploit this by triggering a TypeError, leaking host environment objects, and gaining access to Node.js internals. Users are advised to upgrade to version 3.10.5 or later to address the vulnerability, following similar previous sandbox escape flaws tracked as CVE-2023-30547, CVE-2023-29017, CVE-2022-36067, and CVE-2026-22709.

New Cisco DoS flaw requires manual reboot to revive devices

www.bleepingcomputer.com · 2 months ago

Cisco has released security updates to address a denial-of-service vulnerability affecting Crosswork Network Controller and Network Services Orchestrator systems. The flaw, tracked as CVE-2026-20188, allows unauthenticated attackers to crash systems with a low-complexity attack, requiring manual reboots for recovery. Cisco has not observed active exploitation of CVE-2026-20188, but previously patched similar vulnerabilities, including CVE-2025-20362, CVE-2025-20333, CVE-2022-20653, CVE-2024-20401, and CVE-2025-20115, some of which were used in zero-day attacks. Affected users are urged to upgrade to the fixed software releases specified in Cisco’s advisory.

CISA Warning: High-Severity Linux Flaw Puts Unpatched Systems at Risk

www.techrepublic.com · 2 months ago

NULL

Binance fixed the IP whitelist gap — but the disclosure process is still broken

blog.technopathy.club · 2 months ago

NULL

Iranian state-backed spies pose as ransomware slingers in false flag attacks

www.csoonline.com · 2 months ago

Iranian state-sponsored spies, specifically the MuddyWater group, are impersonating the Chaos ransomware-as-a-service organization to conceal their data theft and cyber-sabotage activities. Attackers use social engineering, including interactive screensharing to steal credentials and bypass multifactor authentication, and establish long-term access using remote management tools. This tactic creates confusion during incident response, diverting attention from deeper security concerns. The group targets organizations in the United States, Western countries, APAC, and the Middle East.

DAEMON Tools devs confirm breach, release malware-free version

www.bleepingcomputer.com · 2 months ago

Disc Soft Limited has confirmed a supply chain attack on its DAEMON Tools Lite software. Hackers trojanized installers, impacting version 12.5.1 (free) released since April 8, and distributed them from the official website. The malicious software stole system information and deployed a backdoor, potentially including QUIC RAT, affecting users in over 100 countries. A malware-free version, 12.6, has been released, and users are advised to uninstall the compromised version and install the new one.

Cisco Enterprise Chat and Email Lite Agent File Upload Vulnerability