Blahalla

CISA Launches ‘CI Fortify’ to Prepare Critical Infrastructure for Geopolitical Cyber Conflict

www.securityweek.com · 2 months ago

The Cybersecurity and Infrastructure Security Agency, or CISA, warns that US critical infrastructure is facing persistent intrusion attempts from nation-state actors. CISA's new CI Fortify initiative emphasizes isolation and recovery capabilities for essential service providers to maintain operations during cyberattacks, anticipating unreliable internet access and hostile actors within networks. Isolation involves severing connections to outside networks, while recovery requires thorough system documentation, backups, and operational rehearsal. CISA urges operators to implement these recommendations and collaborate directly with the agency to strengthen defenses.

Sophisticated Quasar Linux RAT Targets Software Developers

www.securityweek.com · 2 months ago

A new Linux backdoor, named Quasar Linux, has been identified targeting software developers and aiming to steal credentials. The backdoor utilizes a modular design, rootkit capabilities, and evasion techniques to maintain stealth and access infected systems. It specifically seeks developer credentials related to cloud environments, repositories, and package management tools, potentially enabling attackers to publish malicious software. The malware employs a two-tier rootkit architecture and multiple persistence methods to remain undetected.

Salesforce Marketing Cloud Vulnerability Exposes Email Data Risk

gbhackers.com · 2 months ago

Salesforce Marketing Cloud recently addressed critical vulnerabilities that could have allowed attackers to access sensitive marketing data and email content. The issues stemmed from flaws in the platform's templating engine, allowing for template injection, and weaknesses in its "view email in browser" functionality. Attackers could have exploited these vulnerabilities to enumerate subscriber records, forge access tokens, and potentially compromise multiple tenants due to shared infrastructure and legacy cryptographic schemes. Salesforce has implemented fixes, rotated keys, and invalidated older links, assigning multiple CVEs to cover the various root causes.

Palo Alto Networks warns of firewall RCE zero-day exploited in attacks

www.bleepingcomputer.com · 2 months ago

Palo Alto Networks has warned of a critical zero-day vulnerability, CVE-2026-0300, affecting PAN-OS firewalls. The flaw is a buffer overflow that allows unauthenticated attackers to execute code with root privileges on exposed firewalls. Shadowserver is tracking thousands of vulnerable VM-series firewalls online, primarily in Asia and North America. Until a patch is released, Palo Alto Networks advises restricting portal access to trusted networks or disabling it entirely.

Google's Android Apps Get Public Verification to Stop Supply Chain Attacks

thehackernews.com · 2 months ago

false

Argo CD ServerSideDiff Flaw Allows Attackers to Extract Kubernetes Secrets

gbhackers.com · 2 months ago

A critical vulnerability, tracked as CVE-2026-42880, has been discovered in Argo CD that allows attackers to extract Kubernetes Secrets. The flaw stems from a missing authorization and data-masking gap within the Server-Side Diff endpoint, which occurs when the compare-options annotation and mutation webhooks option are enabled. Attackers with basic read-only access can exploit this to obtain sensitive data like service account tokens and database credentials. Patched versions 3.3.9 and 3.2.11 are now available to resolve this issue.

Poisoned truth: The quiet security threat inside enterprise AI

www.csoonline.com · 2 months ago

Enterprise AI systems are vulnerable to data corruption through accidental errors, malicious attacks, or simply poor data hygiene. This "AI data poisoning" can lead to systems making incorrect decisions, impacting areas like access controls and financial approvals, without triggering traditional security alerts. Experts caution organizations are often poisoning their own systems by feeding AI models data from disparate, unverified sources like old documents and conflicting databases. Protecting the integrity of data, not just the AI systems themselves, is crucial, and organizations should focus on understanding data sources and establishing clear governance.

Train like you fight: Why cyber operations teams need no-notice drills

www.csoonline.com · 2 months ago

false

Windows Phone Link Exploited by CloudZ RAT to Steal Credentials and OTPs

thehackernews.com · 2 months ago

Cybersecurity researchers have identified a new attack method utilizing the CloudZ remote access tool and a custom Pheno plugin to steal credentials and one-time passwords. The attack exploits the Microsoft Phone Link application, allowing the plugin to intercept sensitive mobile data without compromising the mobile device itself. Attackers use reconnaissance to gather information about the Phone Link application and transmit it to a command-and-control server. This intrusion has been active since at least January 2026, with an undetermined threat actor responsible.

Government, Scientific Entities Hit via Daemon Tools Supply Chain Attack

www.securityweek.com · 2 months ago

A sophisticated supply chain attack is targeting organizations worldwide through compromised versions of Daemon Tools software. Malicious code was injected into versions 12.5.0.2421 to 12.5.0.2434, affecting government, scientific, manufacturing, and retail entities. The attackers used a backdoor to collect information from thousands of machines across more than 100 countries before deploying a second backdoor and the QUIC RAT to a limited number of high-value targets. AVB Disc Soft, the developer of Daemon Tools, has been notified.

QLNX Targets Developers in Supply Chain Credential Theft Campaign

gbhackers.com · 2 months ago

Researchers have identified a new Linux remote access trojan called QLNX, designed to target developers’ and DevOps credentials to compromise software supply chains. The malware employs fileless execution, rootkit functionality, and credential harvesting, including SSH keys, cloud credentials, and browser data. QLNX uses multiple persistence methods, including systemd services and LDPRELOAD, and employs both userland and kernel-assisted hiding techniques. The tool's design allows attackers to hijack publishing accounts and inject malicious code into widely used packages.

Ransomware Gang Member Linked to Russian Cybercrime Group Sentenced to Prison

gbhackers.com · 2 months ago

A Latvian national has been sentenced to over eight years in prison for his role in a prolific Russian ransomware network. The group targeted over 54 organizations worldwide, stealing data and extorting victims, resulting in losses exceeding hundreds of millions of dollars. The perpetrator specialized in leveraging sensitive information, including children’s medical records, to pressure victims into paying ransom demands. The syndicate used ransomware strains including Akira, Royal, Karakurt, TommyLeaks, and SchoolBoys Ransomware.

Iran-Linked Hackers Target Oman Ministries in Webshell and Data Theft Campaign

gbhackers.com · 2 months ago

Iran-linked threat operators targeted multiple Omani government ministries in a widespread espionage campaign. The attackers exploited exposed webshells and SQL scripts to steal sensitive data, including judicial records and personal identification information. The operation utilized a compromised server in the UAE hosting tools like webshells, C2 code, and exfiltrated data, and leveraged vulnerabilities like CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. The activity demonstrates a pattern of Iranian state-aligned espionage, with connections to earlier attacks and a broader information operations infrastructure.

Zero-Auth Vulnerability Enables Cross-Tenant Access at DoD Contractor

gbhackers.com · 2 months ago

A critical authorization vulnerability was recently discovered in Schemata, an AI-powered training platform used by the United States Department of Defense. This zero-auth flaw allowed unauthorized accounts to access sensitive military training materials, personnel records, and AWS S3 links across different tenant boundaries. The vulnerability, initially reported on December 2, 2025, remained unpatched for nearly 150 days before being resolved on May 1, 2026. This incident highlights the importance of robust tenant isolation and secure API authorization for organizations handling sensitive government data.

Malicious OpenClaw Skill Targets Agentic AI Workflows to Deploy RATs and Stealers

gbhackers.com · 2 months ago

Threat actors are exploiting the OpenClaw AI agent framework to distribute malware. A malicious “DeepSeek‑Claw” skill disguises itself as an integration with DeepSeek but delivers either Remcos RAT or the GhostLoader stealer depending on the platform and installation method. The skill utilizes tactics like DLL sideloading, AMSI patching, and social engineering to evade detection and steal sensitive data, including credentials, browser cookies, and cryptocurrency wallets. Security teams are advised to treat OpenClaw skills as untrusted and implement strict review and monitoring practices.

Oracle Debuts Monthly Critical Security Patch Updates

www.securityweek.com · 2 months ago

Oracle is introducing monthly security patch updates to address critical vulnerabilities more quickly. The first monthly Critical Security Patch Update will be released on May 28, with additional updates planned for June and August. This change allows customers managing their own systems to apply fixes sooner, complementing the standard quarterly updates. Oracle attributes this enhanced responsiveness to the adoption of artificial intelligence for code analysis and vulnerability detection.

Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution

thehackernews.com · 2 months ago

A critical vulnerability in Palo Alto Networks’ PAN-OS software allows unauthenticated attackers to execute code remotely. The flaw, identified as CVE-2026-0300, impacts PA-Series and VM-Series firewalls utilizing the User-ID Authentication Portal, and carries a CVSS score of 9.3 when publicly accessible. Limited exploitation has been observed, targeting portals exposed to the internet. Palo Alto Networks plans to release patches beginning May 13, 2026, and advises restricting portal access or disabling it as a temporary mitigation.

Vimeo Confirms Breach Exposing 119,000 Unique User Email Addresses

gbhackers.com · 2 months ago

Vimeo recently confirmed a data breach impacting approximately 119,000 user email addresses. The breach stemmed from a security compromise at Anodot, a third-party analytics vendor integrated with Vimeo's systems. The extortion group ShinyHunters initially demanded payment before publishing stolen data, primarily consisting of video titles, technical metadata, and customer email addresses. Vimeo reports that login credentials and video content were not compromised and has taken steps to sever the integration with Anodot.

Remus Infostealer Adopts Lumma-Style Browser Key Theft to Bypass App-Bound Encryption

gbhackers.com · 2 months ago

A new infostealer called Remus has emerged, closely resembling the Lumma Stealer codebase. Analysts attribute Remus to the Lumma Stealer family due to overlapping code patterns, obfuscation techniques, and a unique Application-Bound Encryption bypass. Remus targets stored browser passwords, cookies, cryptocurrency wallets, and clipboard data, utilizing techniques like mixed Boolean-arithmetic obfuscation and direct syscalls to evade detection. It employs EtherHiding for C2 resolution and uses a compact shellcode to decrypt browser keys, representing a significant evolution of Lumma's infrastructure and evasion capabilities.

Middle East Cyber Battle Field Broadens — Especially in UAE

www.darkreading.com · 2 months ago

Cyberattacks against the United Arab Emirates have dramatically increased following the recent conflict between Israel and Iran, with daily breach attempts rising from 90,000 to 200,000 prior to the conflict, to a current average of 600,000 to 800,000. Attackers are increasingly targeting critical business sectors like finance and aviation, aiming for disruption rather than physical damage. Experts suggest these attacks may be part of a pressure campaign by Iran to influence negotiations and a potential “new normal” of heightened cyber activity, even after the conflict ends. While AI is assisting attackers, it primarily provides a scaling advantage rather than increased sophistication.

Attackers Bypass Azure AD Conditional Access Using Phantom Device Registration

gbhackers.com · 2 months ago

Researchers have discovered a method to bypass Microsoft Entra ID Conditional Access using a technique called phantom device registration. Attackers can register fake devices with valid Azure AD certificates and keys, allowing them to generate Primary Refresh Tokens that bypass Conditional Access policies. This bypass exploits a vulnerability in the Device Registration Service and a configuration flaw where crucial Conditional Access policies are set to “Report-Only” mode instead of enforcement. The technique has been linked to the Russian state-aligned threat actor Storm-2372 and can lead to privilege escalation and data exfiltration.

Ransomware Gangs Escalate Attacks on Aviation and Aerospace Sector

gbhackers.com · 2 months ago

Ransomware attacks and data extortion are increasingly targeting the aviation and aerospace sector, exploiting shared systems and identity-based access. The compromise of a single vendor, like Collins Aerospace's MUSE system, can disrupt operations at multiple airports. Threat actors, including Qilin, LockBit, and Cl0p, are actively targeting airports, airlines, and suppliers. Emerging threats include identity compromise by groups like Scattered Spider and risks related to satellite dependency.

Critical Palo Alto Firewall Vulnerability Enables Attackers to Gain Root Privileges

gbhackers.com · 2 months ago

A critical vulnerability, tracked as CVE-2026-0300, has been identified in Palo Alto Networks’ PAN-OS software, impacting PA-Series and VM-Series firewalls. The flaw allows unauthenticated attackers to gain root privileges through a buffer overflow in the User-ID Authentication Portal, with limited active exploitation already reported. Affected PAN-OS versions include 12.1, 11.2, 11.1, and 10.2, though Prisma Access, Cloud NGFW, and Panorama are not impacted. Palo Alto Networks plans to release firmware updates between May 13 and May 28, 2026, and advises restricting access to the Authentication Portal or disabling it as a temporary fix.

Palo Alto Networks to Patch Zero-Day Exploited to Hack Firewalls

www.securityweek.com · 2 months ago

Palo Alto Networks is preparing patches to address a critical zero-day vulnerability, identified as CVE-2026-0300. This buffer overflow affects the User-ID Authentication Portal service on PA and VM series firewalls, potentially allowing attackers to execute code with root privileges. Limited exploitation has been observed, suggesting targeted attacks. Patches are expected to be released on May 13 and May 28.

Die besten DAST- & SAST-Tools

www.csoonline.com · 2 months ago

Growing concern about software supply chain vulnerabilities and a recent U.S. executive order have emphasized developer responsibility for shipping secure code and increased demand for application security testing tools. Static application security testing analyzes source code during development and integrates with CI/CD pipelines and IDEs to catch flaws early, while dynamic testing probes compiled applications and web interfaces at runtime to find issues missed by static scans. Organizations are advised to use both approaches or integrated platforms, with leading DAST offerings including Acunetix, Fortify WebInspect, Black Duck Managed DAST, and Tenable Web App Scanning, and leading SAST options including Checkmarx, Fortify Static Code Analyzer, Perforce Klocwork, SpectralOps, and Veracode.

These Countries Embrace E.V.s to Avoid Oil Price Shocks

www.nytimes.com · 2 months ago

There is rising demand for electric vehicles in Costa Rica and in parts of Latin America, Asia and Africa as buyers seek to avoid spiking fuel prices. The shift is being driven by higher gasoline and diesel costs, increased imports of lower-priced electric models and supportive fiscal incentives for electric vehicles. The surge is stressing charging infrastructure and grid capacity while accelerating all-electric vehicle sales and imports. The trend is changing regional vehicle markets and energy demand.

Elon Musk Wanted OpenAI to Go Commercial, Greg Brockman Testifies

www.nytimes.com · 2 months ago

false

Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years

unit42.paloaltonetworks.com · 2 months ago

A critical Linux kernel vulnerability, identified as Copy Fail and tracked as CVE-2026-31431, has been discovered. This flaw allows attackers to gain root access using a small Python script, exploiting a weakness in the system's cryptographic functions. The vulnerability operates by modifying the in-memory cache of privileged executables, bypassing typical detection methods. Security experts recommend immediate patching or mitigation measures, with protection and detection available through certain security products.

New stealthy Quasar Linux malware targets software developers

www.bleepingcomputer.com · 2 months ago

A new Linux implant called Quasar Linux, or QLNX, is targeting developers’ systems and development environments. The malware combines rootkit, backdoor, and credential-stealing capabilities, dynamically compiling components on the target host. It employs multiple persistence mechanisms and features a rootkit designed to conceal its presence at both user and kernel levels, alongside components for credential harvesting, surveillance, and lateral movement. This stealthy malware aims to bypass security controls and compromise software delivery pipelines.

Instructure hacker claims data theft from 8,800 schools, universities

www.bleepingcomputer.com · 2 months ago

A hacker claims to have stolen data from Instructure, a company that provides the Canvas learning management system used by schools and universities. The breach reportedly affects 280 million records from 8,809 institutions, including names, email addresses, and private messages. Threat actors allegedly exploited data export features to harvest user data, and some universities are investigating the potential impact. Security researchers have also discovered that 99 percent of identified vulnerabilities remain unpatched, and an exploit chained four zero-days to bypass security measures.

Supply-chain attacks take aim at your AI coding agents

www.csoonline.com · 2 months ago

North Korean cyber actors, specifically the group known as Famous Chollima, are exploiting AI coding agents through malicious software packages. Attackers create seemingly legitimate packages with persuasive descriptions, often related to cryptocurrency, to entice AI agents to include them in coding projects. This technique, dubbed PromptMink, involves LLM Optimization abuse and knowledge injection, and researchers observed instances of AI agents autonomously selecting these malicious dependencies. Another emerging threat, called “slopsquatting,” occurs when AI agents hallucinate package names, allowing attackers to register malicious packages that developers subsequently use. Security agencies recommend restricting AI agent access, maintaining approved component registries, and implementing Software Bill of Materials practices to mitigate these supply-chain risks.

Apple Reaches $250 Million Settlement Over Claims It Misled People on A.I.

www.nytimes.com · 2 months ago

NULL

Trellix Source Code Breach Highlights Growing Supply Chain Threats

www.darkreading.com · 2 months ago

Cybersecurity vendor Trellix recently experienced a breach where a threat actor gained unauthorized access to a portion of their source code repository. The company states there is no evidence the release process was affected or the code exploited, and they are investigating with forensic experts and law enforcement. This incident follows similar supply chain attacks targeting Trivy and KICS, where the threat group TeamPCP compromised GitHub Actions workflows. Experts note that source code breaches can provide attackers with valuable information about a security product’s design and controls, potentially impacting downstream customers.

Scan. Secure. Simplify. — Free Web Tools Platform

7azzani.com · 2 months ago

false

Research Hub Bridges Cybersecurity Gap for Under-Resourced Organizations

www.darkreading.com · 2 months ago

false

Edge browser leaves passwords exposed in plain text, says researcher

www.csoonline.com · 2 months ago

A Norwegian researcher has discovered that Microsoft Edge's Password Manager saves passwords in plain text within the browser's memory. This poses a security risk, especially on shared computers, as the passwords remain accessible even after the browser is closed. Microsoft claims this behavior is intentional, a response that security experts find unacceptable. Other browsers, like Google Chrome, use encryption methods to protect password data, suggesting Microsoft could implement similar safeguards.

Federal officials will test Google and Microsoft AI models before release

www.washingtonpost.com · 2 months ago

false

Bleeding Llama: Critical Unauthenticated Memory Leak in Ollama (CVE-2026–7482)

www.cyera.com · 2 months ago

A critical security vulnerability, CVE-2026-7482, has been found in the Ollama LLM platform. This vulnerability allows unauthenticated attackers to leak the entire Ollama process memory, potentially exposing sensitive data. The flaw is caused by insufficient validation when processing custom model files, and can be exploited by crafting malicious files. Exploitation can be achieved with only three API calls, leading to significant risk for organizations using Ollama.

Salesforce pentesting novel techniques- how to be an apex predator

www.reco.ai · 2 months ago

There are three novel techniques for pentesting Salesforce Experience sites. One is retrieving all site routes by calling the routerInitializer component via ComponentController.getComponent so pages can be enumerated without guessing. Another is extracting Apex methods by retrieving component definitions from pages rather than only parsing bootstrap JavaScript, and parsing Lightning Web Components as well as legacy components to obtain method descriptors and parameters for fuzzing and invocation. These approaches enable invoking Aura endpoints and Apex controllers to discover accessible objects and fields, and they emphasize rules of engagement such as confirming scope, not modifying other users’ records, and avoiding denial of service.

CISA mulls new three-day remediation deadline for critical flaws

www.csoonline.com · 2 months ago

The Cybersecurity and Infrastructure Security Agency is considering reducing the remediation deadline for critical vulnerabilities in government systems from 14 days to just three days. This potential change is driven by concerns that artificial intelligence models, like Anthropic’s Claude Mythos, could accelerate the discovery and exploitation of vulnerabilities. Experts express mixed reactions, citing concerns about inadequate testing time and agencies’ ability to fully understand their exposure. The move would represent a significant shift in workload and could influence security practices in the private sector.

DAEMON Tools trojanized in supply-chain attack to deploy backdoor

www.bleepingcomputer.com · 2 months ago

Hackers have trojanized installers for DAEMON Tools software, leading to a supply-chain attack impacting thousands of systems across over one hundred countries. The compromised software, versions 12.5.0.2421 through 12.5.0.2434, delivered a backdoor and collected system information. While many systems were infected, only a select few received more advanced payloads, targeting organizations in Russia, Belarus, and Thailand. The attack, which began around April 8, is ongoing, and researchers suspect a Chinese-speaking threat actor is responsible.

Publishers sue Meta, claiming it violated copyrights in training AI with their books

www.washingtonpost.com · 2 months ago

false

Why Security Leadership Makes or Breaks a Pen Test

www.darkreading.com · 2 months ago

The effectiveness of penetration testing hinges on security leadership's commitment before, during, and after the assessment. Leaders must define scope, objectives, and stakeholder alignment beforehand, and ensure findings drive remediation efforts to avoid the test becoming a mere compliance exercise. A well-executed test identifies exploitable weaknesses and informs security investments, while leadership is crucial for fostering a security-aware culture and translating findings into actionable plans rather than blame. Ultimately, a lack of follow-up and accountability after testing significantly diminishes its value.

Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities

sec.cloudapps.cisco.com · 2 months ago

Vulnerabilities exist within Cisco Identity Services Engine software. Versions 3.4 and earlier are affected and users are advised to upgrade to a fixed release. Version 3.5 is not vulnerable to these issues. Consult Cisco’s support page for upgrade instructions.

Coinbase Lays Off 14% of Employees as A.I. Changes Work

www.nytimes.com · 2 months ago

false

New WhatsApp Flaws Could Affect Billions of Users After Meta Security Patch

www.techrepublic.com · 2 months ago

NULL

Student hacked Taiwan high-speed rail to trigger emergency brakes

www.bleepingcomputer.com · 2 months ago

A 23-year-old university student in Taiwan halted four high speed rail trains for 48 minutes on April 5, 2026 by transmitting a high priority General Alarm signal that triggered emergency braking procedures. The student intercepted and decoded TETRA radio parameters using software defined radio equipment and then programmed handheld radios to impersonate legitimate beacons, with a 21-year-old accomplice providing critical THSR parameters, and investigators say the system's parameters had not been rotated for 19 years allowing the attacker to bypass seven verification layers. Police arrested the suspect on April 28, 2026, seized 11 handheld radios, an SDR, and a laptop, and charged him under Article 184 of the Criminal Law with a potential maximum sentence of 10 years while he remains out on NT 100,000 bail and his lawyer says the transmission was accidental.

CISA pushes critical infrastructure operators to prepare to work in isolation

www.csoonline.com · 2 months ago

The US Cybersecurity and Infrastructure Security Agency has launched a national initiative called CI Fortify to help critical infrastructure operators prepare to operate in isolation from the internet and third party dependencies during major cyberattacks. The program emphasizes controlled isolation rather than traditional air gapping and urges operators to map dependencies, build and test local and manual operational capabilities, and restore systems while disconnected, with CISA providing assessments, guidance, exercises, and a pilot phase to scale across sectors. Experts say adoption will be hindered by limited visibility into complex vendor and managed service dependencies, the high cost of redundant infrastructure and standby resources, and the need to redesign remote access for tightly controlled, auditable crisis use.

DigiCert: Misissued code signing certificates

bugzilla.mozilla.org · 2 months ago

A threat actor used a malicious ZIP sent through a customer chat to infect support analyst endpoints in early April 2026 and obtained initialization codes for approved EV code signing orders. Possession of initialization codes plus approved orders allowed the actor to obtain EV Code Signing certificates from multiple CAs, prompting revocation of 60 certificates, 27 of which were explicitly linked to the actor, and some of the compromised certificates were used to sign Zhong Stealer malware. Affected CAs included DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1, DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1, and Verokey High Assurance Secure Code EV. Remediations implemented included canceling pending orders, revoking identified certificates within 24 hours with revocation dates set to issuance dates, masking initialization codes in proxied support sessions, tightening multifactor authentication, disabling Okta FastPass for support, and deploying UI and API changes to prevent similar exposure.

Google AppSheet Abuse Helped Phish 30,000 Facebook Accounts

www.techrepublic.com · 2 months ago

Cybercriminals are exploiting Google's AppSheet platform to conduct phishing campaigns targeting Facebook accounts. The attackers, linked to a Vietnam-based group, have compromised approximately 30,000 accounts by impersonating Meta support or recruiters from well-known companies. These phishing emails bypass standard security measures because they appear to originate from Google’s infrastructure and often display verification marks, increasing their legitimacy. Victims are directed to fake websites where their login credentials are stolen and routed through Telegram bots, enabling account takeover and resale.