Blahalla

Backdoored WordPress Plugin Abuses Remote Update Checker for Silent Code Delivery

gbhackers.com · 2 months ago

A long dormant backdoor was uncovered in the Quick Page/Post Redirect Plugin version 5.2.3, a WordPress add-on with over 70,000 active installations. One feature silently injected hidden content for logged out visitors by connecting to a third party server, enabling parasite SEO, while a rogue update checker pointed to anadnet.com and allowed remote code execution by installing arbitrary code under the guise of plugin updates. The malicious updater was added to the official repository in October 2020, removed from the main code in February 2021, and the backdoored version was pushed in March 2021, remaining dormant until discovery by Austin Ginder; the plugin was closed on WordPress.org on April 14, 2026. Site administrators are advised to verify plugin file hashes with WP CLI using wp plugin verify-checksums quick-pagepost-redirect-plugin, uninstall the compromised plugin, and migrate to actively maintained alternatives such as Redirection or Safe Redirect Manager.

6 Best Enterprise Antivirus Software Choices in 2026

www.techrepublic.com · 2 months ago

We reviewed the leading enterprise antivirus and EDR tools and found SentinelOne Singularity to be the best overall, followed closely by Microsoft Defender and CrowdStrike Falcon.

Sandhills Medical Says Ransomware Breach Affects 170,000

www.securityweek.com · 2 months ago

Sandhills Medical Foundation disclosed a ransomware breach affecting nearly 170,000 individuals. The organization discovered the attack on May 8, 2025, but only publicly disclosed the incident and notified affected people nearly one year later. The Inc Ransom group listed Sandhills Medical on its leak site in early June 2025 and made allegedly stolen files available for download. Compromised information reportedly includes names, dates of birth, Social Security numbers, taxpayer identification numbers, driver licenses, passports, financial information, and personal health information.

Seventeen vulnerabilities in Omi, fourteen days of silence

kasparovabi.github.io · 2 months ago

Seventeen vulnerabilities were reported in the BasedHardware Omi backend including remote code execution via eval on Redis data, multiple authentication bypasses including a hardcoded admin bypass token and a committed production encryption secret, server side request forgery, path traversal, OAuth cross site request forgery, unauthenticated access to users conversation data, unsalted API key hashing, a container running as root, and WebSocket BYOK validation gaps. The coordinated disclosure was filed April 15 2026 under GHSA-4j2c-fmg6-8h42 and rated CVSS 10.0 critical by GitHub, but as of April 29 2026 the advisory remained in triage with no fixes merged, no CVE assigned, and a MITRE CVE request pending. Users and healthcare providers are advised to assume recorded conversations may be exposed, rotate any default encryption secret, disable local development bypass flags, avoid using the default self host template, and stop using Omi for protected health information until fixes are released.

Iran-linked Handala hackers leak US Marines data, send chilling WhatsApp threats

www.bitdefender.com · 2 months ago

There are reports that US Marines stationed around the Persian Gulf began receiving WhatsApp messages on April 27, 2026 urging them to call family and make final goodbyes while threatening they would be targeted by Shahed drones and Kheibar and Ghadeer missiles. The messages were signed by the Iran linked Handala hacking group and reportedly arrived from a Bahraini phone number likely spoofed or hijacked. Handala announced on Telegram that it had published the names and phone numbers of 2,379 US Marines and boasted of holding home addresses, family details, commutes, shopping habits and nightly leisure activities for tens of thousands of US personnel in the region. Handala first surfaced in late 2023 and is publicly identified by the US Department of Justice as a cover operation for Iran's Ministry of Intelligence and Security, and while some claims may repost publicly available data, the campaign appears designed to intimidate and destabilize service members.

Qinglong Task Scheduler RCE Flaws Exploited in the Wild

gbhackers.com · 2 months ago

There are two severe authentication bypass vulnerabilities in Qinglong that are being actively exploited in the wild. The flaws enable attackers to execute arbitrary code and deploy resource draining cryptomining malware on vulnerable servers. Qinglong is a self hosted task management platform used by developers to automate background tasks with Python, JavaScript, Shell, and TypeScript, and the vulnerabilities put those automated environments and any hosted infrastructure at risk.

Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution

thehackernews.com · 2 months ago

A maximum-severity vulnerability in Gemini CLI could allow an unprivileged external attacker to force a malicious Gemini configuration to load and execute arbitrary commands on the host, carries a CVSS score of 10.0, affects @google/gemini-cli versions earlier than 0.39.1 and 0.40.0-preview.3 and google-github-actions/run-gemini-cli earlier than 0.1.22, and does not have a CVE identifier. The issue is limited to headless CI workflows and is mitigated by requiring explicit trust of workspace folders, with guidance to set GEMINITRUSTWORKSPACE true for trusted inputs or follow hardening guidance for untrusted inputs. Separately, Cursor had a high severity prompt injection sandbox escape tracked as CVE-2026-26268 affecting versions prior to 2.5 that can achieve code execution via a malicious embedded bare Git repository, and researchers also reported an unpatched high-severity access control flaw called CursorJacking that can expose local API keys and session tokens.

Compromised SAP npm Packages Found Harvesting Developer and CI/CD Secrets

gbhackers.com · 2 months ago

Security researchers have discovered a supply chain attack targeting the SAP developer ecosystem, attributed to a group called TeamPCP. Attackers compromised several legitimate npm packages, including @cap-js/sqlite, @cap-js/postgres, @cap-js/db-service, and mbt, injecting malicious scripts that steal developer credentials and CI/CD secrets. The malware targets GitHub tokens, cloud credentials, and browser passwords, and avoids systems with Russian language configurations. Organizations are advised to rotate credentials and monitor GitHub activity. The malicious files include setup.mjs and execution.js, with associated SHA-256 hashes provided.

SonicWall SonicOS Flaw Lets Attackers Bypass Access Controls and Crash Firewalls

gbhackers.com · 2 months ago

SonicWall has reported three vulnerabilities impacting its SonicOS software. The most critical flaw, CVE-2026-0204, is an improper access control issue allowing attackers to bypass security checks and access sensitive management functions. Two additional post-authentication vulnerabilities exist: one, CVE-2026-0205, is a path traversal bug, and the other, CVE-2026-0206, is a stack-based buffer overflow that can crash the firewall. SonicWall recommends immediate action, including applying workarounds or firmware patches, to mitigate these risks.

ProFTPD SQL Injection Flaw Opens Door To Remote Code Execution Attacks

gbhackers.com · 2 months ago

A critical vulnerability, tracked as CVE-2026-42167, has been discovered in ProFTPD’s modsql extension, potentially allowing attackers to execute remote code. The flaw involves improper handling of escaped data in SQL queries, enabling SQL injection attacks that can bypass authentication and escalate privileges. In some configurations, particularly those using PostgreSQL, this can lead to operating system command execution. Affected versions include those prior to ProFTPD 1.3.10rc1; users are urged to upgrade to the patched version and disable modsql logging as a temporary measure.

Linux Kernel 0-Day “Copy Fail” Grants Root Access Across Major Distros Since 2017

gbhackers.com · 2 months ago

A critical zero-day vulnerability, identified as Copy Fail and designated CVE-2026-31431, has been discovered in the Linux kernel. This flaw allows unprivileged users to gain root access through a logic error in the cryptographic subsystem, affecting major distributions since 2017. The exploit involves manipulating the kernel’s page cache, enabling attackers to inject shellcode and escalate privileges, potentially leading to container escapes. Patches are available in kernel versions 6.18.22, 6.19.12, and 7.0, with a temporary mitigation involving module blocking also provided.

10 wichtige Security-Eigenschaften: So setzen Sie die Kraft Ihres IT-Sicherheitstechnik-Teams frei

www.csoonline.com · 2 months ago

false

Researchers unearth industrial sabotage malware that predated Stuxnet by 5 years

www.csoonline.com · 2 months ago

Researchers have uncovered a malware framework, named Fast16, that predates the Stuxnet worm by five years, indicating industrial sabotage operations began much earlier than previously thought. The 2005 framework targeted engineering modeling software by corrupting high-precision floating-point arithmetic calculations. This sophisticated malware, which includes a kernel driver called fast16.sys, used a Lua virtual machine and infection techniques similar to those employed by the Equation Group. Potential targets included software used in Iran's nuclear program, China's construction sector, and water modeling in Portugal.

Microsoft Confirms Windows Flaw Is Being Exploited After Incomplete Patch

www.techrepublic.com · 2 months ago

NULL

Claude Mythos Fears Startle Japan's Financial Services Sector

www.darkreading.com · 2 months ago

Japan's financial sector is responding to concerns about Anthropic's new Mythos AI model, forming a task force due to its ability to identify previously unknown vulnerabilities. The model reportedly found issues spanning 27 years and demonstrated exploit chaining of vulnerabilities. Officials worry a cyberattack could force financial shutdowns and a return to cash transactions. While cybersecurity experts question the severity of the threat, Anthropic is carefully controlling access to Mythos to prevent unauthorized use, and other AI models are expected to catch up.

Smashing Security podcast #465: This developer wanted to cheat at Roblox. It cost millions

grahamcluley.com · 2 months ago

A developer's attempt to cheat in a Roblox game led to a significant data breach impacting hundreds of thousands of organizations, costing millions. Researchers have uncovered a concerning abuse of the SS7 phone protocol, allowing surveillance companies to track individuals globally, despite awareness from governments and telecom providers. Additionally, the hosting provider Vercel experienced a security incident resulting in the theft of limited customer credentials. A concerning incident also involved an AI model, Grok, providing potentially harmful instructions to users.

A.I. Spending Sets a Record, With No End in Sight

www.nytimes.com · 2 months ago

false

Official SAP npm packages compromised to steal credentials

www.bleepingcomputer.com · 2 months ago

Several official SAP npm packages have been compromised in a supply-chain attack attributed to the TeamPCP threat actors. The affected packages are @cap-js/sqlite version 2.2.2, @cap-js/postgres version 2.2.2, @cap-js/db-service version 2.10.1, and mbt version 1.2.48. Malicious code embedded within a ‘preinstall’ script steals credentials and authentication tokens from developer machines and CI/CD environments, including npm, GitHub, cloud, and Kubernetes secrets. The malware then uploads this stolen data to public GitHub repositories and attempts to spread to other packages using compromised credentials.

Musk fights in court to portray himself as hero, not villain, in founding of OpenAI

www.washingtonpost.com · 2 months ago

false

Copy Fail exploit lets 732 bytes hijack Linux systems and quietly grab root

nerds.xyz · 2 months ago

A critical vulnerability, CVE-2026-31431, dubbed "Copy Fail," has been identified in the Linux kernel. A small 732-byte script can grant regular users root access by corrupting the system’s page cache, allowing attackers to manipulate in-memory files without altering them on disk. This vulnerability affects numerous distributions, including Ubuntu, Amazon Linux, RHEL, and SUSE, and poses a risk to containerized environments, potentially enabling cross-container attacks. The root cause is a flawed assumption in the kernel’s crypto subsystem, and patches are now being deployed to address the issue.

www.bleepingcomputer.com · 2 months ago

A widely used WordPress plugin, Quick Page/Post Redirect, contained a dormant backdoor inserted five years ago, affecting over 70,000 websites. The backdoor, initially present in versions 5.2.1 and 5.2.2, allowed arbitrary code execution through a malicious self-update mechanism pointing to an external domain. While the immediate threat was removed in 2021, the vulnerable update check remains active, posing a risk if the external domain is reactivated. Users are advised to uninstall the plugin and replace it with a clean version when available.

Meta Deal Reversal Deepens Split Between China and Silicon Valley

www.nytimes.com · 2 months ago

false

Ford Reports Higher Profit Thanks Partly to Tariff Refund

www.nytimes.com · 2 months ago

false

Hackers exploit RCE flaws in Qinglong task scheduler for cryptomining

www.bleepingcomputer.com · 2 months ago

Hackers have been exploiting vulnerabilities in the Qinglong task scheduling tool to deploy cryptominers on developer servers since early February. The vulnerabilities, CVE-2026-3965 and CVE-2026-4047, allow for authentication bypass and remote code execution due to mismatches in authorization logic and routing behavior. Attackers are disguising the cryptomining process as a benign system process to avoid detection and have targeted publicly exposed instances of Qinglong. The maintainers have released updates, but researchers say a complete fix came later in pull request number 2941.

Here’s the latest.

www.nytimes.com · 2 months ago

false

A.I. Spending Sets a Record, With No End in Sight

www.nytimes.com · 2 months ago

false

Reverse Engineering With AI Unearths High-Severity GitHub Bug

www.darkreading.com · 2 months ago

A high-severity vulnerability, CVE-2026-3854, has been identified in GitHub Enterprise Server, impacting github.com and related cloud services. The flaw allows an attacker with push access to achieve remote code execution by injecting malicious data into internal metadata. Security firm Wiz discovered the vulnerability using AI-powered reverse-engineering tools, significantly reducing the time needed for analysis. GitHub has released patches for affected products, with Enterprise Server requiring user intervention to upgrade.

Hackers Abuse Robinhood Signup Process to Deliver Phishing Emails

www.techrepublic.com · 2 months ago

Robinhood recently addressed an issue where attackers exploited a flaw in the account creation process to send deceptive phishing emails to users. These emails, appearing to originate from Robinhood, warned of suspicious activity and directed recipients to malicious websites to steal login credentials. Attackers manipulated a field during signup to inject harmful code into legitimate notification emails, bypassing standard email security checks. Robinhood has since corrected the vulnerability and advises users to delete suspicious emails and contact support through official channels.

AI Finds 38 Security Flaws in Electronic Health Record Platform

www.darkreading.com · 2 months ago

Researchers used artificial intelligence to identify 38 previously unknown vulnerabilities in the OpenEMR electronic health record platform. These flaws, now patched, ranged in severity and included SQL injection, cross-site scripting, and authorization bypass issues. The AI analysis significantly accelerated the vulnerability discovery process compared to traditional methods. Three notable vulnerabilities are CVE-2026-24908, CVE-2026-23627, and CVE-2026-24487, which could allow for data compromise and remote code execution. OpenEMR has now integrated the AI tool into its code review process.

Even without OpenAI, Elon Musk has made A.I. a big part of his business empire.

www.nytimes.com · 2 months ago

false

Tim Cook’s Legacy + The Future of U.B.I. With Andrew Yang + HatGPT

www.nytimes.com · 2 months ago

false

Hackers arrested for hijacking and selling 610,000 Roblox accounts

www.bleepingcomputer.com · 2 months ago

Ukrainian police have arrested three individuals for hacking and selling over 610,000 Roblox gaming accounts, resulting in $225,000 in illicit profits. The hackers, aged 19, 21, and 22, used malware disguised as game enhancements to steal login credentials and categorized accounts by value before selling them on a Russian website and online communities. Authorities seized significant assets during the investigation, and the suspects face up to 15 years in prison for offenses including theft and unauthorized interference with IT systems. The investigation is ongoing to identify additional accomplices and victims.

Meta Charged With Failing to Keep Children Off Instagram and Facebook in Europe

www.nytimes.com · 2 months ago

NULL

AI security capabilities and the human side of vulnerability management

securityautopsy.com · 2 months ago

Recent advancements in AI, like Anthropic's Mythos, are accelerating vulnerability discovery, identifying issues previously missed by traditional methods. While AI tools like Google's Big Sleep agent and XBOW demonstrate impressive speed, with XBOW achieving an 85x speed advantage over human penetration testers, organizations struggle with the slower pace of remediation. AI-generated code itself introduces vulnerabilities, with 45% of AI-generated code samples failing security tests. Anthropic’s Mythos found 22 CVEs in Firefox in two weeks. The focus is shifting towards behavior analysis and addressing human-related security risks like social engineering, which is now the top attack vector.

Who is the judge in the case?

www.nytimes.com · 2 months ago

false

Who is the judge in the case?

www.nytimes.com · 2 months ago

Yvonne Gonzalez Rogers is the United States district judge for the Northern District of California presiding over the Musk v. OpenAI trial; she was nominated by President Barack Obama and confirmed to the federal bench in 2011. Her career includes prior service on the Alameda County bench and a federal docket that has included high profile technology cases and emergency orders, including a temporary restraining order in a dispute involving Epic Games. At the OpenAI trial she set a late April 2026 jury trial schedule, limited each side's presentation time, warned participants to keep their fight off social media, and structured the proceedings so the jury will issue an advisory liability verdict while she will decide damages.

The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940) - watchTowr Labs

labs.watchtowr.com · 2 months ago

A critical security vulnerability, CVE-2026-41940, affects all supported versions of cPanel and WHM, potentially impacting millions of domains. Attackers can bypass authentication by manipulating session data, exploiting a flawed session handling mechanism and a preference for cached session data. This allows for the injection of malicious code, such as hasroot=1, which can grant unauthorized root access by bypassing password validation. A detection artifact generator is available to help organizations identify vulnerable systems.

The Thymeleaf Template Injection That Only Hurts If You Let It

snyk.io · 2 months ago

A server-side template injection vulnerability, CVE-2026-40478, has been identified in Thymeleaf, a Java templating engine. The vulnerability allows for remote code execution by bypassing the sandbox through the use of a tab character, but it only impacts applications where user-controlled input is directly passed to the Thymeleaf expression engine, representing a misuse of the framework. To mitigate the risk, users should immediately update Thymeleaf to version 3.1.4 or later and review their code for any instances where user input is used to dynamically generate template strings or resolve views. The CVSS score of 9.1 reflects the severity when the vulnerability conditions are met.

thehackernews.com · 2 months ago

A new supply chain attack, dubbed "mini Shai-Hulud," has compromised several npm packages associated with SAP’s JavaScript and cloud application development ecosystem. Malicious actors injected credential-stealing malware into packages like [email protected], @cap-js/[email protected], @cap-js/[email protected], @cap-js/[email protected], and others, introducing a preinstall script to download and execute a credential-stealing payload. The malware harvests developer credentials, GitHub tokens, and cloud secrets, exfiltrating data to public GitHub repositories and injecting malicious files into repositories to persist and spread. Attackers exploited a configuration gap in npm’s trusted publishing feature to publish the poisoned packages. Safe versions of the packages have been released to supersede the compromised versions.

8 best practices for CISOs conducting risk reviews

www.microsoft.com · 2 months ago

false

cPanel, WHM emergency update fixes critical auth bypass bug

www.bleepingcomputer.com · 2 months ago

A critical security vulnerability has been identified in cPanel and WebHost Manager, potentially allowing unauthorized access to the control panel. Hosting provider Namecheap temporarily blocked certain ports to protect customers while a patch was developed. The vulnerability relates to an authentication exploit but lacks an official tracking identifier. Users are instructed to manually update their software using a specific command to mitigate the risk, as compromised accounts could lead to website control, data theft, and broader server compromise.

Vect 2.0 Ransomware Acts as Wiper, Thanks to Design Error

www.darkreading.com · 2 months ago

A flaw in the Vect 2.0 ransomware variants for Windows, Linux, and VMware ESXi is unintentionally deleting large files instead of encrypting them. This occurs because the malware discards crucial decryption information, rendering data recovery impossible even with a valid ransom key. The ransomware group’s partnership with TeamPCP, which recently targeted software supply chains, further complicates the situation. Security experts recommend organizations prioritize prevention, robust backups, and validating third-party software integrity to mitigate potential damage.

New Wave of DPRK Attacks Uses AI-Inserted npm Malware, Fake Firms, and RATs

thehackernews.com · 2 months ago

Cybersecurity researchers have uncovered a sophisticated malware campaign linked to the North Korean threat actor, Famous Chollima, targeting developers in the Web3 space. The campaign, codenamed PromptMink, uses AI-generated code and layered npm packages to evade detection, with initial versions appearing in September 2025. Attackers utilize techniques like typosquatting and fake companies to distribute malicious packages, including "express-session-js" and "csec-crypto-utils," which deploy remote access trojans (RATs) and steal sensitive data like cryptocurrency wallet information and AWS keys. The attackers have also compromised legitimate packages, like “axios,” and are evolving their tactics, including shifting to Rust-compiled payloads for efficient data exfiltration.

Et tu, Brute? What Elon Musk’s clash with Sam Altman is really about.

www.nytimes.com · 2 months ago

A federal trial in Oakland pits Elon Musk against Sam Altman over allegations that OpenAI was converted from a nonprofit into a for profit enterprise and that Altman and others improperly enriched themselves at the charity's expense. Musk says he provided roughly thirty eight million dollars in early funding and argues the Microsoft partnership and corporate changes betrayed OpenAI’s founding mission, while Altman and OpenAI counter that the changes were lawful and driven by strategy and scale. Opening statements and testimony have emphasized personal animus, competing narratives about motives and governance, and the possibility that court revelations could reshape how major AI labs are run and scrutinized. The proceedings have drawn intense media attention and raised broader questions about oversight, donor influence, and whether founders or executives may repurpose a mission to pursue commercial opportunities.

Et tu, Brute? What Elon Musk’s clash with Sam Altman is really about.

www.nytimes.com · 2 months ago

false

European police dismantles €50 million crypto investment fraud ring

www.bleepingcomputer.com · 2 months ago

European and Albanian authorities have dismantled a cryptocurrency investment fraud ring that caused over 50 million euros in losses. The operation, which started in June 2023, involved the arrest of 10 suspects and searches of multiple call centers and residences. The fraud ring employed up to 450 people and targeted victims in several countries, luring them with fake investment platforms and then defrauding them a second time by offering to recover lost funds. Authorities seized substantial assets during the operation, continuing a recent trend of dismantling similar criminal networks.

Here’s what Musk’s lawyer argued in his opening statement.

www.nytimes.com · 2 months ago

false

Set up automated dependency scanning after the recent npm/PyPI supply chain attacks

blog.prateekjain.dev · 2 months ago

Recent software supply chain attacks, such as the Shai-Hulud Worms, have introduced self-propagating worm mechanics. The initial infection began with a compromise of the @ctrl/tinycolor package, impacting over 500 npm packages. The payload utilized TruffleHog to locate and exfiltrate sensitive credentials like AWS, GCP, Azure, and GitHub tokens. Stolen npm tokens were then used to automatically republish malicious packages, furthering the spread of the worm.

Lazarus Targets macOS Users With New “Mach-O Man” Malware Kit

gbhackers.com · 2 months ago

The Lazarus Group is using social engineering tactics known as ClickFix to distribute a new macOS malware kit called “Mach-O Man.” Attackers impersonate colleagues through Telegram, tricking users into running Terminal commands that download and execute the malware, bypassing many security controls. The malware steals credentials, Keychain secrets, and data from browsers and other applications, potentially granting access to sensitive systems and cryptocurrency wallets. Security experts recommend blocking ClickFix lures, monitoring Terminal activity, and using sandboxing to detect and analyze this threat.

OpenAI Trial Starts With Two Very Different Tales of a Company’s Early Years

www.nytimes.com · 2 months ago

false