Blahalla

Anthropic Unveils Claude Security to Counter AI-Powered Exploit Surge

www.securityweek.com · 2 months ago

With models like Mythos compressing time to exploit to minutes, defenders face a surge of near instant attacks unless they deploy specialized AI defenses. Anthropic has released Claude Security in public beta to Claude Enterprise customers; it runs on Claude Opus 4.7, is accessible from the Claude sidebar without API integration, and can scan selected repositories, directories, or branches to find vulnerabilities, explain findings, rate confidence, reproduce issues, and generate targeted patching instructions that can be executed with Claude Code on the Web. The product supports scheduled scans for ongoing coverage and is being integrated into major security platforms and professional services so teams can speed remediation and keep pace with AI enabled threats, with rollout to team and Max customers planned soon.
AI Fuels ‘Industrial’ Cybercrime as Time-to-Exploit Shrinks to Hours

www.securityweek.com · 2 months ago

Industrialized cybercrime now delivers attacks with far greater scale, speed and success by using AI, automation and efficient data sharing to turn vulnerabilities into repeatable, business-like exploits. Malicious tools including WormGPT, FraudGPT, HexStrike AI, APEX AI and BruteForceAI automate reconnaissance, attack-path generation, social engineering, code creation and credential attacks, lowering skill and time requirements for attackers. Time-to-exploit for many critical vulnerabilities has collapsed from nearly a week to about 24 to 48 hours and in some cases begins within hours of public disclosure, aided by infostealers and underground markets that sell databases, credentials and validated access. Defenders are urged to match this machine-speed threat with defensive AI and automation, prioritizing identity-centric detection, exposure reduction and faster detection and response.
Here’s the latest.

www.nytimes.com · 2 months ago

NULL
Romanian leader of online swatting ring gets 4 years in prison

www.bleepingcomputer.com · 2 months ago

A Romanian national, 27 year old Thomasz Szabo, extradited from Romania on November 18, 2024, was sentenced to four years in federal prison and three years of supervised release after pleading guilty in June 2025 to one count of conspiracy and one count of threats involving explosives. He founded and led an online community that beginning in late 2020 organized swatting and bomb threats that targeted more than 75 public officials, multiple journalists, four religious institutions, at least 25 members of Congress or their family members, several cabinet and senior executive branch officials, senior federal law enforcement officials, members of the federal judiciary, and dozens of state officials. He personally made false reports including a December 2020 threat to carry out a mass shooting at New York City synagogues and a January 2021 threat to detonate explosives at the U.S. Capitol and kill President elect Joe Biden, and he encouraged followers to carry out similar attacks. An accomplice, 23 year old Nemanja Radovanovic, was also charged in August 2024 and faces separate proceedings while authorities say the scheme wasted taxpayer funds, drained law enforcement resources, and put innocent civilians in harm's way.
FBI links cybercriminals to sharp surge in cargo theft attacks

www.bleepingcomputer.com · 2 months ago

There has been a sharp rise in cyber enabled cargo theft targeting the transportation and logistics industry, with estimated losses in the United States and Canada reaching nearly 725 million dollars in 2025, a sixty percent increase over the prior year, and confirmed incidents rising eighteen percent while the average value per theft grew thirty six percent to 273,990 dollars. Threat actors have been infiltrating broker and carrier systems since at least 2024 using spoofed emails, fake web links and phishing to steal credentials, then posting fraudulent load listings on online load boards, impersonating legitimate companies to divert shipments, rerouting loads to complicit drivers, altering carrier registrations and insurance records, and sometimes demanding ransoms. To mitigate these attacks, companies are urged to verify shipment requests through secondary channels, implement and enforce multi factor authentication, validate unexpected communications with two factor processes, maintain detailed vehicle and driver records, and victims should file complaints with the Internet Crime Complaint Center and with local law enforcement.
PyTorch Lightning and Intercom-client Hit in Supply Chain Attacks to Steal Credentials

thehackernews.com · 2 months ago

Two malicious releases of the Lightning Python package, versions 2.6.2 and 2.6.3, were published on April 30, 2026 and have been quarantined from PyPI as part of a campaign assessed to be an extension of the Mini Shai Hulud incidents linked to TeamPCP. The compromise injects a hidden runtime and a start script that silently downloads the Bun JavaScript runtime and executes an obfuscated payload on import to harvest developer credentials, cloud secrets, and cryptocurrency wallets. Harvested GitHub tokens are validated and then abused to inject wormlike commits across repositories, and a secondary npm propagation modifies local postinstall hooks and repacks tarballs to cause downstream re-publishing; developers are advised to block and remove versions 2.6.2 and 2.6.3, downgrade to 2.6.1, and rotate any exposed credentials.
What’s new, updated, or recently released in Microsoft Security

www.microsoft.com · 2 months ago

There are new Microsoft Defender capabilities in the Agent 365 tooling gateway, now available in preview, that give security teams near real time visibility and control to detect, block, and investigate anomalous or malicious actions by AI agents using webhooks to evaluate and prevent risky activities. There is a generally available integration between Microsoft Defender for Cloud and GitHub Advanced Security that maps code changes to production, prioritizes alerts based on real runtime context, and enables coordinated remediation workflows so teams can track vulnerabilities from source to runtime and use AI powered remediation. There is a new hands on demo for Microsoft Purview Data Security Investigations that shows how analysts can assess data security risk, investigate incidents with AI powered deep content analysis, and visualize risk correlations across sensitive content, users, and activities.
April KB5083769 Windows 11 update causes backup software failures

www.bleepingcomputer.com · 2 months ago

The April 2026 KB5083769 security update breaks third party backup applications on Windows 11 24H2 and 25H2 by causing Volume Shadow Copy Service operations to time out. Affected products include Acronis Cyber Protect Cloud, Macrium Reflect, NinjaOne Backup, and UrBackup Server, and Acronis reports that Pro and Home editions may fail with the error The backup has failed because Microsoft VSS has timed out during the snapshot creation. Workarounds advise uninstalling the Security update for Microsoft Windows KB5083769 via Settings then pausing updates and rebooting while awaiting a fix from Microsoft.
Elon Musk suffered a rare loss in his last jury trial.

www.nytimes.com · 2 months ago

NULL
Email threat landscape: Q1 2026 trends and insights

www.microsoft.com · 2 months ago

During the first quarter of 2026 approximately 8.3 billion email-based phishing threats were detected, with monthly volumes declining from 2.9 billion in January to 2.6 billion in March, and 78 percent of threats delivered via links while malicious payloads fell from 19 percent in January to 13 percent in February and March. QR code phishing more than doubled over the quarter from 7.6 million to 18.7 million, driven mainly by PDF attachments and a 336 percent surge in QR codes embedded directly in email bodies in March. CAPTCHA-gated phishing exploded in March to 11.9 million attacks after earlier declines, and a coordinated disruption of the Tycoon2FA phishing as a service operation in early March corresponded with an approximate 15 percent decrease in associated email volume as adversaries shifted hosting and domain registration tactics. Business email compromise accounted for about 10.7 million attacks in the quarter, and defenders should note emerging techniques such as device code phishing sometimes enabled by tools like EvilTokens.
Musk says he ‘was a fool’ to provide OpenAI’s early funding.

www.nytimes.com · 2 months ago

Elon Musk testified in a federal trial in Oakland that he was a fool for providing about 38 million dollars in early funding to launch OpenAI and said he believed the company abandoned its nonprofit mission. OpenAI’s lawyer conducted an at-times testy cross-examination that sought to show Musk had supported or tolerated moves toward a for-profit model, and jurors were shown messages in which Musk referred to himself as a fool. The exchanges spotlighted disputes over control and Microsoft’s involvement, with the judge imposing limits but indicating that questioning on certain topics would resume.
PromptMink: ReversingLabs discloses 7-month DPRK supply chain campaign using LLM Optimization (LLMO) to target AI coding agents via npm

blog.barrack.ai · 2 months ago

There is a supply chain campaign called PromptMink attributed to the North Korean group Famous Chollima that engineered malicious npm and PyPI packages specifically to deceive AI coding agents into installing credential stealing malware, and ReversingLabs publicly disclosed the campaign on April 29, 2026. The attackers used a two layer architecture of polished bait SDK packages that list disposable stealer packages such as validate sdk v2 so that an AI agent like Claude Code would add a dependency that in turn installs precompiled binaries or single executable bundles to evade LLM inspection. The malware evolved through four phases from LLM obfuscated JavaScript to Python ports to large SEA bundles and finally NAPI RS native addons, adding SSH backdoors, in memory project zipping, and exfiltration of env files, configuration files, SSH keys, and entire source trees, while republishing removed packages within hours to maintain operational continuity.
Musk Says He ‘Was a Fool’ to Provide OpenAI’s Early Funding

www.nytimes.com · 2 months ago

false
SonicWall Urges Immediate Patching of Firewall Vulnerabilities

www.securityweek.com · 2 months ago

There are three SonicOS vulnerabilities affecting Gen 6, Gen 7, and Gen 8 SonicWall firewalls that could be exploited to bypass security controls, access restricted services, or crash devices. One high severity flaw is tracked as CVE-2026-0204 and allows attackers to bypass access controls and access certain management interface functions, while the two medium severity issues are CVE-2026-0205, a path traversal weakness that can interact with restricted services, and CVE-2026-0206, which can be used to crash firewalls. Fixes are available in firmware releases 6.5.5.2-28n, 7.3.2-7010, and 8.2.0-8009 and customers are urged to apply the patches immediately or temporarily restrict management access to SSH only by disabling HTTP and HTTPS based management and SSLVPN until they can patch.
SAP NPM Packages Targeted in Supply Chain Attack

www.securityweek.com · 2 months ago

Four SAP npm packages used in the Cloud Application Programming ecosystem and cloud deployment workflows were injected with malicious code as part of a supply chain campaign called Mini Shai Hulud. On April 29 the flagged versions were mbt 1.2.48, cap js db service 2.10.1, cap js postgres 2.2.2, and cap js sqlite 2.2.2, and the injected preinstall hook fetched and executed a Bun binary from a GitHub repository to bypass security monitoring while the malicious versions were available for about two to four hours. The payload is an information stealer that harvests local credentials, GitHub and npm tokens, cloud secrets for AWS, Azure and GCP and other deployment artifacts, exfiltrates them to public GitHub repositories, and uses compromised CI tokens to modify and republish packages, an activity that security firm Wiz links to the TeamPCP group.
Inspektor Gadget Security Audit - Shielder

www.shielder.com · 2 months ago

Inspektor Gadget, an eBPF based observability framework for Linux and Kubernetes, was audited in early 2026 under OSTIF and three vulnerabilities were identified, two rated medium and one rated low. The issues were a command injection in the gadget build flow due to Makefile variable interpolation, a denial of service caused by a hard coded 256 kilobyte kernel ring buffer that dropped events, and unsanitized ANSI escape sequences in terminal output. Maintainers addressed the flaws by refactoring the build to Go tooling in release v0.51.1, adding detection for dropped events, and sanitizing terminal output, and the audit recommended enforcing TLS by default, pinning dependency hashes in CI, adding a Kubernetes namespace blocklist, and automating third party vulnerability scanning. The audit also documented gadget bypasses including use of openat2 and newer mount APIs, jumbo frames, IPv6 SNI differences, static linking and io uring evasion and concluded that the framework remains useful for defense in depth while operators must be aware of tracing limitations and harden standalone deployments accordingly.
Anti-DDoS Firm Heaped Attacks on Brazilian ISPs

krebsonsecurity.com · 2 months ago

A Brazilian anti DDoS company called Huge Networks was tied to a botnet that carried out extended, massive attacks against Brazilian ISPs after an exposed archive contained malicious Python attack scripts and private SSH keys belonging to the company’s CEO. The botnet scanned for and commandeered TP Link Archer AX21 routers vulnerable to CVE 2023 1389 and used a Mirai variant to launch DNS reflection and amplification attacks limited to Brazilian IP address ranges, with scripts showing attacks of ten to sixty seconds per prefix and coordination from a Digital Ocean server. The CEO said two development servers and his personal SSH keys were compromised in January 2026, that keys were rotated and third party forensics engaged, and he denied authorizing the attacks while alleging a competitor may be responsible.
What Happens in the First 24 Hours After a New Asset Goes Live

www.bleepingcomputer.com · 2 months ago

When a new internet routable asset appears, automated scanners detect and catalog open ports, server banners, and certificates within five to sixty minutes. Within one to six hours attackers enumerate service versions, open management ports, and TLS certificate pivots to discover related infrastructure. Between six and twelve hours active probing escalates to credential stuffing, directory brute forcing, database probes for unauthenticated access, and automated testing of known vulnerabilities. By twenty four hours many vulnerable or misconfigured assets are compromised, and a deployed honeypot study found eighty percent of common service traps were breached within one day.
ThreatsDay Bulletin: SMS Blaster Busts, OpenEMR Flaws, 600K Roblox Hacks and 25 More Stories

thehackernews.com · 2 months ago

Canadian authorities arrested three men for operating an SMS blaster that impersonated cellular towers to send phishing texts and connected tens of thousands of devices. Multiple supply chain attacks and data abuses were disclosed, including npm packages impersonating TanStack that exfiltrated environment variables, a malicious PyPI release of elementary-data that stole developer credentials, and browser extensions and phishing kits that harvest and sell user data while using fake base transceiver stations for targeted SMS campaigns. Researchers found widespread exposure of remote access servers with more than 19,000 RDP hosts still vulnerable to BlueKeep CVE-2019-0708 and many VNC servers lacking authentication, and OpenEMR patches addressed 38 flaws including critical vulnerabilities CVE-2026-24908 and CVE-2026-23627 that could enable SQL injection, data exfiltration, and remote code execution. Active exploitation was observed against the Qinglong timed task platform via authentication bypasses CVE-2026-3965 and CVE-2026-4047 that led to remote code execution and cryptocurrency miner deployments, and legitimate remote management tools were noted being abused by attackers.
New Linux ‘Copy Fail’ flaw gives hackers root on major distros

www.bleepingcomputer.com · 2 months ago

An exploit has been published for a local privilege escalation vulnerability dubbed Copy Fail that affects Linux kernels released since 2017 and allows an unprivileged local attacker to gain root, tracked as CVE-2026-31431. The flaw is a logic bug in the kernel crypto path that lets an attacker use AFALG sockets together with the splice system call to perform a controlled four byte write into a file page cache and alter setuid root binaries, and researchers published a 732 byte proof of concept that succeeds across major distributions including Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16. Upstream fixes reverting the in place crypto optimization were released on April 1 in kernel versions 6.18.22, 6.19.12, and 7.0, distributions are pushing updates, and interim mitigations include blocking AFALG socket creation or disabling the algifaead module until kernels are updated.
Oracle Red Bull Racing Team Revs Up Automation to Boost Security

www.darkreading.com · 2 months ago

Oracle Red Bull Racing implemented 1Password tooling to automate credential management, govern access, and manage SaaS with the goals of increasing speed and improving security across roughly two thousand employees, thousands of servers, and more than one hundred service accounts. Engineers faced implementation hurdles learning the API and reconciliation processes, and worked with consultants to configure the system for the high-performance computing, infrastructure, and aerodynamics teams. Automation centralized credentials into vaults, enforced least privilege and better password hygiene, enabled a single-click reset that cut wind tunnel recovery from about one hour to two minutes, and reduced emergency wake-up calls for investigations.
Phishing is no longer human as AI now drives 86 percent of attacks

nerds.xyz · 2 months ago

A recent report finds that eighty six percent of phishing attacks are now AI driven, marking a major shift in attacker tactics. These campaigns have expanded beyond email to target collaboration tools such as Teams and calendar invites and exploit trust in workplace systems. Attackers are using convincing internal impersonation and multi channel setups that increase credibility, raising concerns that organizations may need AI based defenses because humans alone will struggle to detect them.
New Python Backdoor Uses Tunneling Service to Steal Browser and Cloud Credentials

thehackernews.com · 2 months ago

A stealthy Python backdoor framework named DEEPDOOR establishes long-term persistence on Windows hosts and is capable of harvesting browser credentials, SSH keys, and cloud credentials for Amazon Web Services, Google Cloud, and Microsoft Azure. The intrusion chain begins with a batch script called installobf.bat that disables Windows security controls, extracts an embedded Python payload named svc.py, and achieves persistence via Startup folder scripts, Registry Run keys, scheduled tasks, and optional WMI subscriptions while using a watchdog to recreate removed artifacts. Once active, the implant communicates over a Rust-based public TCP tunneling service bore.pub for command and control, provides reverse shell and reconnaissance, records keystrokes, captures screenshots, webcam and ambient audio, and employs extensive anti-analysis and telemetry tampering such as AMSI and ETW patching, NTDLL unhooking, Microsoft Defender tampering, SmartScreen bypass, PowerShell logging suppression, command-line wiping, timestamp stomping, and log clearing to minimize detection and forensic visibility.
Critical Gemini CLI Flaw Enabled Host Code Execution, Supply Chain Attacks

www.securityweek.com · 2 months ago

A critical remote code execution vulnerability was discovered in Gemini CLI, an open source AI agent that automatically trusted the current workspace folder and loaded any agent configuration found there without review, enabling planted malicious configuration to execute arbitrary commands on the host before sandbox initialization. Exploitation could allow an unprivileged external attacker to steal tokens, access secrets and source code, and gain lateral movement, turning CI CD workflows into supply chain attack paths. Google released patches for the Gemini CLI and the run-gemini-cli GitHub Action and advised upgrading to patched versions to harden workspace trust and tool allowlisting. Researchers at Novee Security reported the issue, assigned a CVSS score of 10.0, and noted that the attack did not rely on prompt injection or model decisions but on infrastructure level execution before the agent had to reason.
Dismantle implicit trust in OT networks, CISA tells critical infrastructure operators

www.csoonline.com · 2 months ago

The US Cybersecurity and Infrastructure Security Agency and four partner agencies have directed operational technology owners to assume adversaries may already be inside networks and to adopt a zero trust approach tailored for industrial systems supporting power, water, transportation, building automation, and weapons-support infrastructure, issuing a 28-page guide developed with the Department of War, the Department of Energy, the FBI, the Department of State, and technical contributions from NIST. The guidance tells operators to segment Active Directory into separate forests or domains, avoid direct trust between IT and OT identity systems, enforce multi-factor authentication at jump hosts, vault and record privileged sessions, and apply just-in-time, time-bound remote vendor access. It emphasizes that integrity and authentication through digital signing are frequently more critical than confidentiality in OT because encryption can introduce latency that disrupts safety-critical operations, and that zero trust must be implemented with operational awareness to avoid creating new risks. The agencies pointed to activity by the threat group known as Volt Typhoon and to exploitation of legacy edge devices and zero-day flaws, and recommended strategic procurement, adversary-aligned testing of boundaries, and caution that AI-driven security agents can become high-value targets.
EnOcean SmartServer Flaws Expose Buildings to Remote Hacking

www.securityweek.com · 2 months ago

Two vulnerabilities affect EnOcean SmartServer, a multi-protocol gateway and edge controller used to unify building automation in smart buildings, factories, and data centers, and are tracked as CVE-2026-22885 and CVE-2026-20761. The flaws allow remote attackers targeting internet-exposed devices to bypass memory protections, leak memory, and execute arbitrary commands, enabling full takeover of Linux-based devices and root privileges by controlling an argument passed to a system call. EnOcean released SmartServer 4.6 update 2 build 4.60.023 to patch the vulnerabilities, which also impact legacy i.LON devices, and Claroty has published technical details and proof-of-concept exploits.
Critical cPanel and WHM bug exploited as a zero-day, PoC now available

www.bleepingcomputer.com · 2 months ago

There is a critical authentication bypass vulnerability CVE-2026-41940 in cPanel, WHM, and WP Squared that stems from a carriage return line feed injection in the login and session loading processes and has been actively exploited in the wild with exploitation attempts observed as early as February 23, 2026. cPanel released fixes on April 28, 2026 for multiple releases and strongly recommends restarting the cpsrvd service after installing updates, while vendors and hosting providers advised temporary mitigations such as blocking external access to ports 2083, 2087, 2095, and 2096 or stopping the cpsrvd and cpdavd services. Detection and verification scripts are available and recommended incident response actions include purging sessions, resetting all credentials, auditing logs, and investigating for persistence.
Seventeen vulnerabilities in Omi, fourteen days of silence

kasparovabi.github.io · 2 months ago

There are seventeen vulnerabilities in the Omi backend used by the Omi wearable, including remote code execution via eval on Redis, authentication bypasses, a hardcoded production encryption key in the public repository, server-side request forgery, path traversal, OAuth CSRF, and unauthenticated access to users personal conversation data, and GitHub rated the aggregate severity as CVSS 10.0 Critical. The researcher privately filed GHSA-4j2c-fmg6-8h42 on April 15, 2026 and reports that after fourteen days the advisory remained in triage with zero patches merged while the repository received more than 300 unrelated commits and two public pull requests exposed the same vulnerable file paths. No CVE had been assigned at publication and a CVE request was submitted to MITRE on April 20, 2026; users are advised to assume conversations may be stored in a system with an active CVSS 10 RCE and to mitigate by deleting sensitive recordings, rotating any default encryption secret when self-hosting, and disabling development bypass flags.
Max-severity RCE flaw found in Google Gemini CLI

www.csoonline.com · 2 months ago

There is a maximum severity remote code execution vulnerability in the Google Gemini CLI package and its GitHub Action that can be triggered when the tool processes untrusted inputs in continuous integration and continuous delivery headless environments. An attacker could inject malicious workspace configurations that are loaded as Gemini configuration and trigger command execution on the host before the agent sandbox initialized, and Google assessed the flaw with a CVSS score of 10.0. Google removed implicit workspace trust in non interactive environments, enforced explicit trust decisions and tool allowlisting, and released fixes in Gemini CLI versions 0.39.1 and 0.40.0 preview 3 and in the GitHub Action version 0.1.22, and users who pinned versions are advised to upgrade and review existing configurations.
EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades

thehackernews.com · 2 months ago

A sophisticated high-resilience campaign identified in March 2026 targets enterprise administrators, DevOps engineers, and security analysts by impersonating administrative utilities and using SEO poisoned search results to direct victims to facade GitHub repositories that link to malicious payloads. The attackers employ a dual-stage GitHub architecture where clean README storefronts redirect users to hidden repositories hosting malicious MSI installers that mimic tools such as PsExec, AzCopy, Sysmon, LAPS, and Kusto Explorer to maximize compromise of high-privilege accounts. Executed installers run an obfuscated batch dropper that downloads a Node.js runtime and deploys EtherRAT, a JavaScript remote access trojan that uses layered AES-256-CBC encryption, in-memory loaders, and a blockchain based dead drop resolver that queries an Ethereum smart contract to dynamically retrieve live command and control addresses. Atos Threat Research Center observed 44 separate malicious GitHub facades deployed between December 2025 and April 1, 2026, and warns that the combination of SEO poisoning and decentralized C2 gives the campaign high resilience to takedowns and traditional blocklisting.
Police dismantles 9 crypto scam centers, arrests 276 suspects

www.bleepingcomputer.com · 2 months ago

A joint international operation led by Dubai Police with U.S. and Chinese authorities dismantled nine cryptocurrency investment fraud centers and arrested at least 276 suspects. The networks ran pig butchering romance baiting schemes that built trust to lure victims into fake cryptocurrency investment platforms, immediately seized transferred funds and laundered them through other crypto accounts while encouraging victims to borrow or take loans to invest more. Among those charged, Burmese national Thet Min Nyi faces wire fraud and money laundering conspiracy counts as an alleged manager and recruiter, and Indonesian nationals Wiliang Awang, Andreas Chandra, and Lisa Mariam face wire fraud conspiracy charges tied to other alleged scam rings, while investigators identified numerous U.S. victims and reported millions of dollars in losses.
Critical cPanel & WHM Vulnerability Exploited as Zero-Day for Months

www.securityweek.com · 2 months ago

A critical authentication bypass in cPanel and WHM, tracked as CVE-2026-41940 with a CVSS score of 9.8, has been exploited as a zero day for months and can allow unauthenticated attackers to gain administrative access and take over affected servers. Exploitation has been observed since February 23, 2026, and roughly 1.5 million internet-accessible cPanel instances may be exposed. The flaw lets attackers manipulate pre-authentication session files and inject credentials via the authorization header to authenticate, enabling modification of server configurations and compromise of websites on shared hosting. Patches were released across multiple cPanel versions, vendors published detection scripts and tools, and some hosting providers blocked cPanel ports while applying fixes.
PoC Disclosed for Critical Root ASUSTOR ADM RCE Flaw

gbhackers.com · 2 months ago

A critical OS command injection vulnerability tracked as CVE-2026-6644 was uncovered in ASUSTOR ADM affecting the PPTP VPN Client and carries a CVSS v4.0 score of 9.4. The flaw allows an authenticated administrator to inject a crafted PPTP server address into pppd via the pty directive, enabling arbitrary root command execution and a Python proof of concept has been disclosed, with exploitation requiring prior admin access but eased by devices that ship with default credentials. ASUSTOR released a fix in ADM version 5.1.3.RGO1 and administrators are advised to update firmware, change default passwords, avoid exposing the management interface to the internet, require VPN or restricted networks for management access, and disable unnecessary services.
Fast16 Malware

www.schneier.com · 2 months ago

Researchers have reverse engineered a piece of malware named Fast16 that appears to be state sponsored and likely originated in the United States. It dates to around 2005 and was likely deployed against Iranian targets years before Stuxnet. Fast16 spreads across networks using a wormlike mechanism and installs a kernel driver that reads application memory to silently alter high precision computation and simulation software results. The malware’s rules point to targets including MOHID, PKPM, and LS DYNA and are designed to introduce subtle errors that can produce faulty research outcomes or catastrophic failures in physical equipment.
OpenAI Unveils Cyber Defense Roadmap Focused on AI-Powered Security

gbhackers.com · 2 months ago

OpenAI released a comprehensive cyber defense roadmap called Cybersecurity in the Intelligence Age to equip defenders with AI powered security tools faster than malicious actors can adapt, and the effort was spearheaded by Sasha Baker in April 2026. The plan centers on five pillars, including a Trusted Access for Cyber program that grants verified security professionals and critical infrastructure operators tiered access to advanced defensive models, plus strengthened government and industry coordination for real time threat intelligence sharing. It also mandates tighter internal protections and continuous monitoring with operational levers to downgrade or revoke access during elevated threats, while expanding consumer facing protections to help everyday users detect scams and secure accounts.
‘Copy Fail’ Logic Flaw in Linux Kernel Enables System Takeover

www.securityweek.com · 2 months ago

A high severity logic bug in the Linux kernel's authencesn AEAD template, tracked as CVE-2026-31431 and dubbed Copy Fail, allows unprivileged local attackers to write four bytes into the page cache of readable files and obtain a root shell. The flaw stems from a 2017 in place optimization that placed page cache pages into a writable scatterlist while authencesn uses the caller's destination scatterlist as scratch space, which lets a four byte write land past the AEAD tag into the cached copy of another file. Exploitation requires only local code execution and can be achieved with a small 732 byte Python script, making it particularly dangerous for multi tenant systems, shared kernel containers, and continuous integration runners since changes occur in memory without altering files on disk. Patches remove the 2017 optimization by reverting to out of place operation or disabling the algifaead module, and organizations are urged to update their kernels or disable the module until fixes are deployed.
SAP npm package attack highlights risks in developer tools and CI/CD pipelines

www.csoonline.com · 2 months ago

A supply chain attack called mini Shai Hulud infected SAP related npm packages used in JavaScript and cloud application development, including mbt version 1.2.48 and cap‑js packages db‑service 2.10.1, postgres 2.2.2 and sqlite 2.2.2, with malicious versions published on April 29 and later replaced by safe releases. The malicious install time code stole developer credentials, GitHub and npm tokens, GitHub Actions secrets, and cloud credentials for AWS, Azure, GCP and Kubernetes, encrypted the stolen data and uploaded it to public GitHub repositories, and used stolen tokens to add malicious GitHub Actions workflows and publish poisoned package versions. Researchers report the attackers abused a misconfigured npm OIDC trusted publishing setup for cap js and likely a static npm token for mbt, and attempted persistence and propagation via Visual Studio Code and Claude Code configuration files such as tasks.json and settings.json, underscoring that a single compromised developer identity can act as a master key into CI CD pipelines and the wider software supply chain.
New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions

thehackernews.com · 2 months ago

Cybersecurity researchers disclosed a high severity Linux local privilege escalation vulnerability tracked as CVE-2026-31431 and codenamed Copy Fail by Xint.io and Theori. The flaw, assigned a CVSS score of 7.8, allows an unprivileged local user to write four controlled bytes into the page cache of any readable file on a Linux system, enabling escalation to root. Administrators are advised to apply vendor patches or mitigations as they become available to prevent local exploitation.
Attackers Exploit cPanel Authentication Bypass 0-Day After PoC Release

gbhackers.com · 2 months ago

A critical zero-day vulnerability tracked as CVE-2026-41940 is being actively exploited across the web hosting industry. A CRLF injection in the session loading and saving process lets unauthenticated attackers inject a malicious security token to bypass cPanel and WHM authentication, permitting full administrative control and remote code execution that can be used for configuration changes, data exfiltration, or ransomware deployment. Patched releases are available for supported cPanel and WHM branches and for WP Squared, and administrators are advised to run the cPanel update script and restart the cpsrvd service, scan session directories for indicators such as multi line password values and attacker injected cp security token values, purge active sessions, force root password resets, and block inbound control panel ports 2083, 2087, 2095, and 2096 until systems are patched.
Jenkins Plugin Updates Fix Path Traversal and Stored XSS Bugs

gbhackers.com · 2 months ago

There are seven vulnerabilities across widely used Jenkins plugins including high severity path traversal and stored cross site scripting flaws that could enable arbitrary code execution or session hijacking. The most severe is CVE-2026-42520 in the Credentials Binding Plugin where unsanitized file names could allow attackers who can supply credentials to write files to arbitrary node locations and escalate to remote code execution, and it has been patched. Two high severity stored XSS issues are CVE-2026-42523 in the GitHub Plugin and CVE-2026-42524 in the HTML Publisher Plugin, and four medium severity issues are CVE-2026-42519, CVE-2026-42521, CVE-2026-42522 and CVE-2026-42525 affecting Script Security, Matrix Authorization Strategy, GitHub Branch Source and Microsoft Entra ID plugins, so administrators are urged to update affected plugins immediately.
Struggling With Phone Addiction? Try These Remedies.

www.nytimes.com · 2 months ago

Counting minutes is a poor way to curb phone habits. There are more effective remedies, including mindful parenting, curated content to limit addictive feeds, and stronger human connection to replace screen time.
High Fidelity Check for the cPanel Authentication Bypass (CVE-2026-41940)

slcyber.io · 2 months ago

There is a cPanel authentication bypass tracked as CVE-2026-41940 that can give an unauthenticated attacker a login session for any user, including root via WHM. Many published proofs of concept and scanners produce false negatives because cPanel can expose management functionality through proxy subdomain paths even when management ports are closed, and because cpaneld requires the tested username to exist as a hosting account while WHM behaves differently. Built-in protections such as cphulkd account lockouts and authorized WHM root IP restrictions can interfere with detection by causing lockouts or blocking root logins, so naive checks that try root or cause failed logins will miss vulnerable systems. A high-fidelity detection method uses randomized usernames on WHM and injects an expired session flag to validate session injection without triggering protections, and an open-source scanner implements these techniques.
How Good Is Google’s Gemini AI at Making Travel Plans?

www.nytimes.com · 2 months ago

Gemini acts as a digital Swiss Army knife for planning flights, activities and routes, drawing on Google Flights, Hotels and Maps to build itineraries and find real time options. It can generate packing lists and compact routes quickly, but it is not infallible and can omit obvious items such as underwear. Travelers should treat its suggestions as a starting point and verify bookings and critical details with official airline, hotel and government sources.
ODNI to CISOs on threat assessments: You’re on your own

www.csoonline.com · 2 months ago

The 2026 Office of the Director of National Intelligence Annual Threat Assessment shifts from long term global forecasting to active operational reporting and a homeland centric focus, reducing its value as an early warning source for private sector security leaders. The assessment omits the prior granular tracking of infrastructure campaigns, including references to pre positioned access campaigns like Volt Typhoon and Salt Typhoon, leaving systemic infiltration risks less visible to enterprises. The net effect is that forecasting adversary adaptation and long term strategic intent is now largely a private sector responsibility, with the public report focused on domestic metrics and kinetic defense outcomes. Security leaders are therefore urged to fund a resilience premium and prioritize identity and insider integrity, dormant access audits for industrial control systems, AI and quantum resilience planning, and deeper public private intelligence sharing.
Stopping the quiet drift toward excessive agency with re-permissioning

www.csoonline.com · 2 months ago

AI agents are moving from producing text to executing multi step tasks that connect to tools, data and other agents, expanding reach and creating a security gap as interoperability accelerates adoption. Over permissioning is producing excessive agency because many organizations grant agents broader access than necessary, enabling unauthorized actions such as unintended data exposure or integrity impacting changes. Three systemic risks are model opacity that hinders auditing, human overreliance that reduces oversight, and supply chain style attacks that manipulate inputs or services feeding agents. The recommended response is re permissioning through continuous permission audits, full visibility, mandatory human oversight for sensitive actions, least privilege context sharing, and vetting and patching integrations and third parties.
Backdoored WordPress Plugin Abuses Remote Update Checker for Silent Code Delivery

gbhackers.com · 2 months ago

A long dormant backdoor was uncovered in the Quick Page/Post Redirect Plugin version 5.2.3, a WordPress add-on with over 70,000 active installations. One feature silently injected hidden content for logged out visitors by connecting to a third party server, enabling parasite SEO, while a rogue update checker pointed to anadnet.com and allowed remote code execution by installing arbitrary code under the guise of plugin updates. The malicious updater was added to the official repository in October 2020, removed from the main code in February 2021, and the backdoored version was pushed in March 2021, remaining dormant until discovery by Austin Ginder; the plugin was closed on WordPress.org on April 14, 2026. Site administrators are advised to verify plugin file hashes with WP CLI using wp plugin verify-checksums quick-pagepost-redirect-plugin, uninstall the compromised plugin, and migrate to actively maintained alternatives such as Redirection or Safe Redirect Manager.
6 Best Enterprise Antivirus Software Choices in 2026

www.techrepublic.com · 2 months ago

We reviewed the leading enterprise antivirus and EDR tools and found SentinelOne Singularity to be the best overall, followed closely by Microsoft Defender and CrowdStrike Falcon.
Sandhills Medical Says Ransomware Breach Affects 170,000

www.securityweek.com · 2 months ago

Sandhills Medical Foundation disclosed a ransomware breach affecting nearly 170,000 individuals. The organization discovered the attack on May 8, 2025, but only publicly disclosed the incident and notified affected people nearly one year later. The Inc Ransom group listed Sandhills Medical on its leak site in early June 2025 and made allegedly stolen files available for download. Compromised information reportedly includes names, dates of birth, Social Security numbers, taxpayer identification numbers, driver licenses, passports, financial information, and personal health information.
Seventeen vulnerabilities in Omi, fourteen days of silence

kasparovabi.github.io · 2 months ago

Seventeen vulnerabilities were reported in the BasedHardware Omi backend including remote code execution via eval on Redis data, multiple authentication bypasses including a hardcoded admin bypass token and a committed production encryption secret, server side request forgery, path traversal, OAuth cross site request forgery, unauthenticated access to users conversation data, unsalted API key hashing, a container running as root, and WebSocket BYOK validation gaps. The coordinated disclosure was filed April 15 2026 under GHSA-4j2c-fmg6-8h42 and rated CVSS 10.0 critical by GitHub, but as of April 29 2026 the advisory remained in triage with no fixes merged, no CVE assigned, and a MITRE CVE request pending. Users and healthcare providers are advised to assume recorded conversations may be exposed, rotate any default encryption secret, disable local development bypass flags, avoid using the default self host template, and stop using Omi for protected health information until fixes are released.
Iran-linked Handala hackers leak US Marines data, send chilling WhatsApp threats

www.bitdefender.com · 2 months ago

There are reports that US Marines stationed around the Persian Gulf began receiving WhatsApp messages on April 27, 2026 urging them to call family and make final goodbyes while threatening they would be targeted by Shahed drones and Kheibar and Ghadeer missiles. The messages were signed by the Iran linked Handala hacking group and reportedly arrived from a Bahraini phone number likely spoofed or hijacked. Handala announced on Telegram that it had published the names and phone numbers of 2,379 US Marines and boasted of holding home addresses, family details, commutes, shopping habits and nightly leisure activities for tens of thousands of US personnel in the region. Handala first surfaced in late 2023 and is publicly identified by the US Department of Justice as a cover operation for Iran's Ministry of Intelligence and Security, and while some claims may repost publicly available data, the campaign appears designed to intimidate and destabilize service members.