no alarms and no surprises please..
-
Guten Tag, Bonjour, Hola to Our European Cyber Defenders!
Guten Tag, Bonjour, Hola to Our European Cyber Defenders! We’re thrilled to unveil the latest evolution of Dark Reading’s DR Global section — your go-to source for region-specific cybersecurity intelligence beyond North America. Tara Seals Go to gbhackers.com
-
Is ‘Tech-xit’ Imminent? UK Steps Up Sovereignty Push Amid AI Strife
Is ‘Tech-xit’ Imminent? UK Steps Up Sovereignty Push Amid AI Strife The US government’s restrictions on Anthropic and OpenAI frontier models have intensified calls in the UK and other countries to reduce their reliance on US tech companies, with significant cyber implications. Rob Wright Go to gbhackers.com
-
Claude Flaw Automatically Sends Malicious Prompts to AI Agents
Claude Flaw Automatically Sends Malicious Prompts to AI Agents When combined with another exploit, the “PromptFiction” vulnerability, which has been fixed, could have enabled an end-to-end attack on a targeted system. Elizabeth Montalbano Go to gbhackers.com
-
2-Click Cursor Exploit Enables Dev Environment Takeover
2-Click Cursor Exploit Enables Dev Environment Takeover Simple age-old bugs give bad actors access to developers’ secrets and source code-rich environments. Nate Nelson Go to gbhackers.com
-
Dell Warns of Critical PowerProtect Data Domain Flaws Allowing Remote Attackers to Take Complete…
Dell Warns of Critical PowerProtect Data Domain Flaws Allowing Remote Attackers to Take Complete… Dell has recently disclosed two critical vulnerabilities in PowerProtect Data Domain appliances that could allow unauthenticated remote attackers to gain complete control of affected… Delivered by PolitePaul service Go to gbhackers.com
-
11 Malicious NuGet Game Cheat Packages Deploy Pepesoft Windows Surveillance Malware
11 Malicious NuGet Game Cheat Packages Deploy Pepesoft Windows Surveillance Malware 11 malicious NuGet packages masquerading as game cheats, automation bots, and management “panels” that deploy a Windows payload called pepesoft.exe. The packages were published… Delivered by PolitePaul service Go to gbhackers.com
-
SheetAgent RAT Runs 14 Virtual Machine Checks and Self-Deletes When Analysis Is Detected
SheetAgent RAT Runs 14 Virtual Machine Checks and Self-Deletes When Analysis Is Detected A threat campaign targeting Indian government job seekers is using a recruitment notice for Senior Field Officer positions in the Cabinet Secretariat as a… Delivered by PolitePaul service Go to gbhackers.com
-
FaceTime Scammers Combine Credential Theft, Remote-Access Apps, and iOS Exploits for Device Takeover.
FaceTime Scammers Combine Credential Theft, Remote-Access Apps, and iOS Exploits for Device Takeover. Apple-focused scam operations are increasingly using FaceTime as a high-trust social-engineering channel to steal credentials and, in higher-risk cases, prepare victims for device compromise…. Delivered by PolitePaul service Go to gbhackers.com
-
Microsoft Fixes Multiple Windows RDP Flaws Exposing Sensitive Data Over the Network
Microsoft Fixes Multiple Windows RDP Flaws Exposing Sensitive Data Over the Network Microsoft has addressed multiple information-disclosure vulnerabilities in the Windows Remote Desktop Protocol (RDP). This widely used service enables remote administration and access to Windows… Delivered by PolitePaul service Go to gbhackers.com
-
CISA warns admins to patch actively exploited SharePoint flaws
CISA warns admins to patch actively exploited SharePoint flaws The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned Tuesday that attackers are actively exploiting three vulnerabilities to hack Internet-exposed on-premises SharePoint Server instances. […] Sergiu Gatlan Go to bleepingcomputer
-
Microsoft: Some Dell PCs shut down after recent Windows updates
Microsoft: Some Dell PCs shut down after recent Windows updates Microsoft is blocking this month’s Windows 11 security updates on some Dell devices because they are causing shutdowns and performance issues. […] Sergiu Gatlan Go to bleepingcomputer
-
US charges alleged operators of Russian bulletproof hosting service
US charges alleged operators of Russian bulletproof hosting service U.S. federal prosecutors have unsealed charges against three Russian nationals, accusing them of providing bulletproof hosting (BPH) services to ransomware gangs that caused over $62 million in damages to victims worldwide. […] Sergiu Gatlan Go to bleepingcomputer
-
SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now
SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as CVE-2026-15409 and CVE-2026-15410, in zero-day attacks and urges customers to install the newly released security updates. […] Lawrence Abrams Go to bleepingcomputer
-
Spanish Police take down €140 million cyber fraud ring, arrest four
Spanish Police take down €140 million cyber fraud ring, arrest four The Spanish Police dismantled a cybercrime and money-laundering organization that made €140 million ($160 million) from investment fraud and business email compromise (BEC) attacks. […] Bill Toulas Go to bleepingcomputer
-
Critical SonicWall Firewall 0-Day Vulnerabilities Actively Exploited in Attacks
Critical SonicWall Firewall 0-Day Vulnerabilities Actively Exploited in Attacks SonicWall has issued an urgent security advisory regarding two vulnerabilities affecting its SMA1000 Series appliances. The company is warning that attackers are actively exploiting these flaws in real-world attacks. The most critical issue, tracked as CVE-2026-15409, carries a maximum CVSS severity score of 10.0 and can…
-
Researcher Claims Bypass of EU Age Verification App Using Chrome Extension
Researcher Claims Bypass of EU Age Verification App Using Chrome Extension Security researcher Paul Moore has once again exposed critical weaknesses in the EU’s flagship age verification system, this time by bypassing the latest app release (version 2026.07-1) using a Chrome extension powered by ClaudeAI. The proof-of-concept shows that, despite months of “security hardening,” a…
-
Chinese Hackers Embed Claude Code and DeepSeek in AI-Powered Government Cyberattacks
Chinese Hackers Embed Claude Code and DeepSeek in AI-Powered Government Cyberattacks An active, highly structured intrusion campaign co-opting commercial artificial intelligence platforms as operational engines for state-sponsored operations. Rather than acting as peripheral research tools, Claude Code and DeepSeek-v4-pro were embedded directly into the core execution flows of a China-linked cyber espionage campaign. The operation…
-
Gamers Download Fake Cheats and Hand Attackers a Live Remote Control of Their Windows PCs
Gamers Download Fake Cheats and Hand Attackers a Live Remote Control of Their Windows PCs New research uncovered 11 malicious NuGet packages disguised as game cheats, bots, and management panels for popular online titles. The campaign targets gaming communities playing titles such as Albion Online, GTA5RP, GrandRP, Majestic RP, and Throne and Liberty. Once installed,…
-
New LegacyHive Windows 0-day Vulnerability Allows Users to Load Another User’s Registry
New LegacyHive Windows 0-day Vulnerability Allows Users to Load Another User’s Registry A proof-of-concept exploit dubbed LegacyHive has been released, enabling a Windows elevation-of-privilege vulnerability in the Windows User Profile Service that allows a standard user to load another user’s registry hive under their own registry classes root. Registry hives are files that store configuration…
-
Nigeria Deepens Cybersecurity Efforts as Cybercriminals See More Profits
Nigeria Deepens Cybersecurity Efforts as Cybercriminals See More Profits The West African country advanced rules to force organizations to disclose cyberattacks, joining other nations in a shift to mandated transparency. Robert Lemos Go to gbhackers.com
-
Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands
Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands SonicWall has warned of active exploitation of two zero-day vulnerabilities impacting Secure Mobile Access (SMA) 1000 series appliances, one of which could be exploited to achieve arbitrary command execution. The vulnerabilities are listed below – CVE-2026-15409 (CVSS score: 10.0) – A Server-side request forgery…
-
Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack
Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack Microsoft shipped its largest Patch Tuesday on record today, and two of the fixes close holes that attackers are already exploiting. The release covers 622 of Microsoft’s own CVEs by its Security Update Guide count, more than triple June’s previous high of around 200. Those two live…
-
SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data
SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data SAP has rolled out updates to address multiple vulnerabilities as part of its July 2026 security updates, including a critical flaw in SAP NetWeaver Application Server ABAP. The vulnerability in question is CVE-2026-44747 (CVSS score: 9.9), an out-of-bounds write flaw that allows…
-
Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads
Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads Any other browser extension that can run a script on claude.ai can still trigger Claude for Chrome tasks aimed at your Gmail, your latest Google Doc and its comments, and your Calendar. Both this and ClaudeBleed need a rogue extension that can already…
-
LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts
LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts Cybersecurity researchers have flagged a previously undocumented Rust-based remote access trojan (RAT) codenamed LabubaRAT that masquerades as NVIDIA software to blend into target environments. “LabubaRAT creates a reusable foothold for hands-on activity,” Blackpoint Cyber researchers Sam Decker and Nevan Beal said in an analysis published today.…
-
Upcoming Speaking Engagements
Upcoming Speaking Engagements This is a current list of where and when I am scheduled to speak: I’m speaking (virtually) at the Policy-Relevant Privacy Research Workshop in Calgary, Canada, on Monday, July 20, 2026. I’m speaking at Boston Leadership Exchange in Boston, Massachusetts, USA, on Wednesday, July 22, 2026. I’m speaking at Cognitive Security Conference…
-
Vulnerability in FIFA’s Network
Vulnerability in FIFA’s Network FIFA’s network was vulnerable to anyone with even minimal access. Bruce Schneier Go to bruce schneier
-
ISC Stormcast For Wednesday, July 15th, 2026 https://isc.sans.edu/podcastdetail/10008, (Wed, Jul 15th)
ISC Stormcast For Wednesday, July 15th, 2026 https://isc.sans.edu/podcastdetail/10008, (Wed, Jul 15th) (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Go to isc.sans.edu
-
Recent DShield SIEM Update, (Tue, Jul 14th)
Recent DShield SIEM Update, (Tue, Jul 14th) The last update to the DShield SIEM [4] was in Sep 2025 which contained some minor tweaks. This update currently is using ELK stack version 8.19.15, contains some additional dashboards and new logs. The following have been added to the DShield SIEM to provide additional information about what…
-
Microsoft Patch Tuesday July 2026 – The AI Acopolypse is Here , (Tue, Jul 14th)
Microsoft Patch Tuesday July 2026 – The AI Acopolypse is Here , (Tue, Jul 14th) This patch Tuesday includes a staggering 622 vulnerabilities, not including another 427 vulnerabilities in Chromium, affecting Microsoft’s Edge browser. 62 of the vulnerabilities are rated critical. One was disclosed before today, and two have already been exploited. Given the large number…
-
Microsoft Patches a Record 570 Security Flaws
Microsoft Patches a Record 570 Security Flaws Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to vulnerability discoveries…
-
The ransomware negotiator who was working for the other side
The ransomware negotiator who was working for the other side When a company falls victim to a ransomware attack, it is not uncommon for it to turn to experts for help. Specialist ransomware negotiation firms handle communications with criminal gangs on a victim’s behalf. What victims don’t expect is that their trusted negotiator might be…
-
Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes
Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes Three of the 622 CVEs for which Microsoft issued patches this week are zero-days; there are more than 60 critical vulnerabilities. Jai Vijayan Go to gbhackers.com
-
6 GHz Wi-Fi Flaws Could Disrupt Critical Systems
6 GHz Wi-Fi Flaws Could Disrupt Critical Systems Automated Frequency Coordination systems by default trust client-side data, which could lead to location spoofing and other attacks that disrupt traffic. Alexander Culafi Go to gbhackers.com
-
Manage Vendor Risk in a Few Practical Steps
Manage Vendor Risk in a Few Practical Steps Risk tolerance, exposure visibility, board oversight — handling third-party risk is complicated but achievable with disciplined, precise governance. Daniel Nutkis Go to gbhackers.com
-
Frontier AI: The Genie’s Out of the Bottle, But Where’s the Rulebook?
Frontier AI: The Genie’s Out of the Bottle, But Where’s the Rulebook? Cutting-edge artificial intelligence models are deploying with more independence and less human oversight. Several state governments are trying to legislate transparency in their use. Arielle Waldman Go to gbhackers.com
-
Cursor IDE Auto-Executes Malicious Code in Poisoned Repos
Cursor IDE Auto-Executes Malicious Code in Poisoned Repos Researchers reported the vulnerability to Cursor in December, but it still remains in the popular AI coding platform and can be exploited in poisoned repository attacks. Alexander Culafi Go to gbhackers.com
-
SAP July 2026 Patch Day Fixes Critical NetWeaver, Approuter, and Commerce Cloud Vulnerabilities
SAP July 2026 Patch Day Fixes Critical NetWeaver, Approuter, and Commerce Cloud Vulnerabilities SAP’s July 2026 Security Patch Day addresses multiple high-impact vulnerabilities across its enterprise products, including a severe memory corruption issue in the SAP NetWeaver… Delivered by PolitePaul service Go to gbhackers.com
-
WinFsp Race Condition Flaw Allows Attackers to Gain SYSTEM-Level Access on Windows
WinFsp Race Condition Flaw Allows Attackers to Gain SYSTEM-Level Access on Windows A newly disclosed vulnerability in the Windows File System Proxy (WinFsp) could allow a local attacker to gain SYSTEM-level privileges by exploiting a race… Delivered by PolitePaul service Go to gbhackers.com
-
ShinyHunters Hackers Abuse Salesforce OAuth to Bypass MFA and Exfiltrate CRM Data
ShinyHunters Hackers Abuse Salesforce OAuth to Bypass MFA and Exfiltrate CRM Data A series of high-impact campaigns linked by overlapping tradecraft to ShinyHunters, in which attackers abused trusted Salesforce OAuth relationships to bypass conventional MFA protections,… Delivered by PolitePaul service Go to gbhackers.com
-
Pro-Iran Hacktivist Groups Launch DDoS and Hack-and-Leak Attacks Against Critical Infrastructure
Pro-Iran Hacktivist Groups Launch DDoS and Hack-and-Leak Attacks Against Critical Infrastructure A decentralized network of pro-Iran hacktivist groups is intensifying cyber operations against critical infrastructure, government entities, technology providers, and organizations perceived as aligned with… Delivered by PolitePaul service Go to gbhackers.com
-
ModHeader Chrome Extension Exposes 900,000 Users to Potential Browsing History Theft
ModHeader Chrome Extension Exposes 900,000 Users to Potential Browsing History Theft ModHeader version 7.0.187.0.187.0.18, a popular Chrome extension used for modifying HTTP headers, contained dormant code capable of collecting and exfiltrating browsing history data from… Delivered by PolitePaul service Go to gbhackers.com
-
US sanctions VPN, malware providers for enabling ransomware attacks
US sanctions VPN, malware providers for enabling ransomware attacks The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned two individuals and one entity for enabling ransomware attacks against U.S. organizations. […] Sergiu Gatlan Go to bleepingcomputer
-
Japan’s largest taxi operator shuts systems after cyberattack
Japan’s largest taxi operator shuts systems after cyberattack Japan’s largest taxi operator, Nihon Kotsu, announced that its systems were compromised in a cyberattack, forcing the company to shut down part of its infrastructure. […] Bill Toulas Go to bleepingcomputer
-
Hackers backdoor Jscrambler npm package with infostealer malware
Hackers backdoor Jscrambler npm package with infostealer malware The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm package that has been downloaded almost 1,500 times. […] Bill Toulas Go to bleepingcomputer
-
New CrashStealer malware poses as Apple crash reporting tool
New CrashStealer malware poses as Apple crash reporting tool A new macOS information-stealing malware called CrashStealer pretends to be Apple’s crash-reporting tool to steal credentials, keychain data, and crypto wallets. […] Bill Toulas Go to bleepingcomputer
-
CISA warns of actively exploited RCE flaws in Joomla extensions
CISA warns of actively exploited RCE flaws in Joomla extensions The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are exploiting vulnerabilities in the iCagenda and Balbooa Forms extensions for Joomla to achieve remote code execution through arbitrary file uploads. […] Bill Toulas Go to bleepingcomputer
-
Chrome Extension Used by 1.6 Million Users Silently Included Data Exfiltration Capabilities
Chrome Extension Used by 1.6 Million Users Silently Included Data Exfiltration Capabilities A widely used browser extension, ModHeader, has been removed from the Chrome Web Store after researchers found that its signed release contained a dormant capability to collect, encrypt, and potentially upload users’ browsing-domain data. The extension reportedly had about 1.6 million combined installations…
-
Telegram’s t.me Domain Suspended, ServerHold Status Breaks Links Worldwide
Telegram’s t.me Domain Suspended, ServerHold Status Breaks Links Worldwide Telegram’s core t[.]me domain has been placed on serverHold at the .me registry, a registry-level status that removes the domain from the global DNS and breaks every t[.]me short link worldwide. WHOIS records confirm the domain now carries eight status flags, including serverHold, clientDeleteProhibited, and serverDeleteProhibited,…
-
New macOS Stealer Mimics Apple’s Crash Report Framework to Steal Browser Credentials
New macOS Stealer Mimics Apple’s Crash Report Framework to Steal Browser Credentials CrashStealer, a native C++ macOS infostealer that disguises itself as Apple’s built-in crash-reporting utility to harvest browser credentials, cryptocurrency wallets, password manager data, and keychain contents before encrypting and exfiltrating everything to a remote command-and-control server. Jamf first spotted a suspicious sample on…
-
Torq and Criminal IP Partner to Deliver Decision-Ready Threat Intelligence for Autonomous SOC Operations
Torq and Criminal IP Partner to Deliver Decision-Ready Threat Intelligence for Autonomous SOC Operations Torrance, California, USA, July 13th, 2026, CyberNewswire Criminal IP, the cyber threat intelligence search engine and attack surface management platform, today announced a new partnership and integration with Torq, the established agentic security operations leader. The partnership integrates Criminal IP’s decision-ready…
-
Turla Hackers Exploit SharePoint Flaw to Access Thousands of French User Accounts
Turla Hackers Exploit SharePoint Flaw to Access Thousands of French User Accounts Turla, a long-running cyber espionage operation linked by French authorities to Russia’s Federal Security Service, has again drawn attention after investigators detailed compromises affecting French organizations. The group has been active for more than two decades and is known for quietly stealing sensitive…
-
Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths
Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths Attackers whose methods line up with the data-extortion group ShinyHunters have spent the past year walking into corporate Salesforce environments without exploiting a single flaw in the platform. The way in has been the trust the organization had already extended, usually through the OAuth connections that tie…
-
CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks
CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks Cybersecurity researchers have flagged a new macOS information stealer called CrashStealer that’s capable of harvesting sensitive data from compromised systems. Unlike other information stealers that are built on AppleScript droppers or Objective-C-based wrappers, CrashStealer is implemented in native C++, according to Jamf Threat Labs. “It…
-
Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found
Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found Google and Microsoft have pulled ModHeader, a popular header-editing extension with roughly 1.6 million installs across Chrome and Edge, after researchers found a hidden browsing-history collector built into its official store version. The collector was dormant. An empty allow-list kept it switched…
-
⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More Somewhere right now, a security tool is quietly finding bugs faster than any human can fix them. That’s supposed to be the good news. The catch is that the attackers have the same tools, pointed the other way, and they don’t…
-
New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email
New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email Give an AI assistant a memory and access to your inbox, and you hand an attacker a way to rewrite what it thinks it knows about you. A single email can trick that agent into saving a false “fact” about the user,…
-
AI Data Centers and the Concentration of Wealth
AI Data Centers and the Concentration of Wealth This essay was written with Nathan E. Sanders, and originally appeared in The Guardian. Opposition to AI data centers has emerged as a primary theme in US politics, one that—surprisingly—doesn’t fall along party lines. We applaud people coming together for constructive debate on any issue, and agree…
-
ISC Stormcast For Tuesday, July 14th, 2026 https://isc.sans.edu/podcastdetail/10006, (Tue, Jul 14th)
ISC Stormcast For Tuesday, July 14th, 2026 https://isc.sans.edu/podcastdetail/10006, (Tue, Jul 14th) (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Go to isc.sans.edu
-
Someone Is Scanning for Your MCP Servers and AI Assistant Credentials, (Mon, Jul 13th)
Someone Is Scanning for Your MCP Servers and AI Assistant Credentials, (Mon, Jul 13th) The setup I pulled 14 days of Apache and ModSecurity logs from a single small web host. Nothing special about it. A handful of low-traffic virtual hosts. A WordPress site, a couple of custom application backends, a static devotional site. The…
-
Lessons Learned from CISA’s Recent GitHub Leak
Lessons Learned from CISA’s Recent GitHub Leak The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a recent data leak in which a contractor published dozens of internal CISA credentials — including AWS Govcloud keys — in a public GitHub repository for almost six months before being notified by KrebsOnSecurity. Experts say…
-
Weak Security Continues to Fuel Russian Cyberattacks
Weak Security Continues to Fuel Russian Cyberattacks In a first, the UK and the EU jointly impose sanctions on Russian individuals and entities for cyberattacks and disinformation campaigns in the region. Jai Vijayan Go to gbhackers.com
-
‘Yellow Teams’ Are Defining the Future of AI Security
‘Yellow Teams’ Are Defining the Future of AI Security In some companies, engineers are building defense and attack tools to test the potential of artificial intelligence for cybersecurity — and its threat. Nate Nelson Go to gbhackers.com
-
GigaWiper Lets Threat Actors Choose Their Own Destructive Attack
GigaWiper Lets Threat Actors Choose Their Own Destructive Attack A modular implant borrows from various malware families to combine both backdoor and wiper activities to maximize impact and minimize operational output. Elizabeth Montalbano Go to gbhackers.com
-
Debian 13.6 Released With Security Updates for Linux, Apache, Curl, QEMU, and More
Debian 13.6 Released With Security Updates for Linux, Apache, Curl, QEMU, and More The Debian Project has released Debian 13.6, the sixth point update for its stable Debian 13 “trixie” distribution. This update, released on July 11,… Delivered by PolitePaul service Go to gbhackers.com
-
BusySnake Stealer Uses Reverse SSH Tunnels and AI-Generated Loaders to Evade Detection
BusySnake Stealer Uses Reverse SSH Tunnels and AI-Generated Loaders to Evade Detection Armored Likho, a previously undocumented threat group also tracked as Eagle Werewolf based on circumstantial evidence, is targeting government institutions and electric-power organizations across… Delivered by PolitePaul service Go to gbhackers.com
-
CISA Warns of Actively Exploited iCagenda and Balbooa Forms File Upload Flaws
CISA Warns of Actively Exploited iCagenda and Balbooa Forms File Upload Flaws The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two file-upload vulnerabilities, affecting iCagenda and Balbooa Forms, to its Known Exploited Vulnerabilities (KEV)… Delivered by PolitePaul service Go to gbhackers.com
-
Spear-Phishing Campaign Uses Proton Drive Links and LNK Files to Deliver SpyGlace
Spear-Phishing Campaign Uses Proton Drive Links and LNK Files to Deliver SpyGlace The APT-C-60 threat actor has continued targeting Japanese organizations with a spear-phishing campaign that abuses Proton Drive, Windows shortcut files, trusted developer platforms, and… Delivered by PolitePaul service Go to gbhackers.com
-
Critical WordPress OAuth SSO Plugin Flaw Allows Unauthenticated Attackers to Gain Admin Access
Critical WordPress OAuth SSO Plugin Flaw Allows Unauthenticated Attackers to Gain Admin Access A critical authentication bypass vulnerability has been disclosed in the widely used miniOrange OAuth Single Sign-On (SSO) WordPress plugin, carrying a near-maximum CVSS score… Delivered by PolitePaul service Go to gbhackers.com
-
US and allies warn of Russian critical infrastructure attacks
US and allies warn of Russian critical infrastructure attacks Cybersecurity agencies from the United States and eight other countries have issued a joint warning that Russian state hackers are targeting vulnerable and poorly configured routers to infiltrate critical infrastructure networks. […] Sergiu Gatlan Go to bleepingcomputer
-
OpenAI temporarily relaxes GPT-5.6 Sol usage limits
OpenAI temporarily relaxes GPT-5.6 Sol usage limits OpenAI is temporarily relaxing GPT-5.6 Sol usage after demand for the company’s most powerful model surged over the past 48 hours. […] Mayank Parmar Go to bleepingcomputer
-
Claude Fable 5 stays free for paid users until July 19 as Anthropic buys more time
Claude Fable 5 stays free for paid users until July 19 as Anthropic buys more time Anthropic has just extended access to Claude Fable 5 for paid subscribers until July 19, giving you another week to keep using the most powerful model. […] Mayank Parmar Go to bleepingcomputer
-
RedHook Android malware now uses Wireless ADB for shell access
RedHook Android malware now uses Wireless ADB for shell access A new version of the RedHook Android malware abuses the Android Wireless Debugging (Wireless ADB) mechanism in a novel way to gain shell-level privileges without requiring a computer connection. […] Bill Toulas Go to bleepingcomputer
-
Hackers Compromised jscrambler With 15,800+ Weekly Downloads to Attack Developers
Hackers Compromised jscrambler With 15,800+ Weekly Downloads to Attack Developers A supply chain attack on the jscrambler npm package, a JavaScript code-protection tool with over 15,800 weekly downloads, involved malicious versions that silently deployed native malware on Linux, macOS, and Windows systems. Socket Research Team detected the first malicious release, [email protected], on July 11, 2026,…
-
Anthropic Extends Claude Fable 5 Access From July 12 to July 19
Anthropic Extends Claude Fable 5 Access From July 12 to July 19 Anthropic has extended promotional access to Claude Fable 5 until July 19, 2026, giving eligible paid subscribers more time to use the company’s newest AI model at no additional charge. The offer was previously scheduled to end earlier. However, Anthropic confirmed that access…
-
SpyGlace Attacks Abuse Trusted Developer Services to Evade Network Detection
SpyGlace Attacks Abuse Trusted Developer Services to Evade Network Detection SpyGlace has returned in a campaign that hides malicious activity behind online services many companies trust. The operation, linked to APT-C-60, uses spear-phishing emails to steer victims toward a booby-trapped archive and then installs malware through a chain of ordinary tools. The latest activity shows…
-
Hackers Weaponize Real Academic Event Materials to Infect Researchers With RokRAT
Hackers Weaponize Real Academic Event Materials to Infect Researchers With RokRAT A targeted phishing campaign is using genuine academic event details to trick researchers into opening malware. The operation delivers a RokRAT variant through a fake document package that appears connected to a real seminar. The attackers used information from an actual academic event to…
-
One Misconfigured Python HTTP Server Exposed Three Active Campaigns from Attackers
One Misconfigured Python HTTP Server Exposed Three Active Campaigns from Attackers A forgotten web server can become a window into a criminal operation. In this case, a Python HTTP service left exposed on a virtual private server revealed the working materials of several attackers. The discovery offers a rare look at how phishing operations can…
-
iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days
iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation in the wild. The vulnerabilities, both rated 10.0 on the CVSS scoring…
-
ISC Stormcast For Monday, July 13th, 2026 https://isc.sans.edu/podcastdetail/10004, (Mon, Jul 13th)
ISC Stormcast For Monday, July 13th, 2026 https://isc.sans.edu/podcastdetail/10004, (Mon, Jul 13th) (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Go to isc.sans.edu
-
Wireshark 4.6.7 Released, (Sat, Jul 11th)
Wireshark 4.6.7 Released, (Sat, Jul 11th) Wireshark release 4.6.7 fixes 12 vulnerabilities and 16 bugs. Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Go to isc.sans.edu
-
Australia warns of global campaign targeting vulnerable CMS platforms
Australia warns of global campaign targeting vulnerable CMS platforms The Australian Cyber Security Centre (ACSC) issued an alert about a global exploitation campaign targeting vulnerable content management systems (CMS) and plugins. […] Bill Toulas Go to bleepingcomputer
-
Apple Sues OpenAI and Former Employees for Alleged Theft of Trade Secrets
Apple Sues OpenAI and Former Employees for Alleged Theft of Trade Secrets Apple has filed a federal lawsuit against OpenAI, accusing the ChatGPT maker of orchestrating a systematic campaign to steal confidential hardware designs, manufacturing processes, and supplier relationships through more than 400 former Apple employees now working at OpenAI. The 41-page complaint, filed July…
-
Microsoft Teams on macOS Screen Sharing Bug Causing Blank Screens
Microsoft Teams on macOS Screen Sharing Bug Causing Blank Screens Microsoft has confirmed a known issue in Teams on macOS that causes screen sharing to fail, freeze, or show a blank black screen during meetings. The bug affects users running macOS versions older than macOS Tahoe 26.4, and Microsoft has now updated its rollout timeline…
-
New Ghostcommit Attack Hides Malicious Prompts in Images to Exploit AI Agents
New Ghostcommit Attack Hides Malicious Prompts in Images to Exploit AI Agents A novel supply chain attack called “Ghostcommit” that conceals prompt-injection instructions within PNG images to bypass AI code reviewers and trick coding agents into leaking secrets such as .env files. The ASSET Research Group demonstrated that a pull request containing an explicit, plain-text…
-
Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install
Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install The jscrambler npm package was compromised, and simply installing its 8.14.0 release runs an infostealer on your machine. Published on July 11, 2026, the malicious version carries a preinstall hook that drops and executes a native binary, one build each for Windows, macOS, and Linux. Socket flagged the release six…
-
Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns
Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns Cybersecurity researchers have disclosed details of sustained cyber espionage activity against several Pakistani law enforcement organizations undertaken by suspected China- and India-aligned threat actors between February 2024 and April 2026. “At Balochistan Police, the compromised assets included servers hosting web applications that manage police and citizen…
-
Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions
Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions Zimbra is urging customers to apply updates to address a critical security vulnerability impacting the Classic Web Client that could result in arbitrary code execution. The vulnerability has been described as a case of stored cross-site scripting (XSS) that could allow specially…
-
AWS GovCloud Credential Leak Leads CISA to Share Critical Cyber Incident Lessons
AWS GovCloud Credential Leak Leads CISA to Share Critical Cyber Incident Lessons The Cybersecurity and Infrastructure Security Agency (CISA) has disclosed details of an internal security incident involving exposed AWS GovCloud credentials, offering a transparent account… Delivered by PolitePaul service Go to gbhackers.com
-
Hackers Infect C++ and C# Project Files to Spread Multi-Stage Windows Backdoor
Hackers Infect C++ and C# Project Files to Spread Multi-Stage Windows Backdoor A sophisticated Windows Trojan that compromises software development projects to distribute a multi-stage backdoor, data stealer, clipboard hijacker, cryptominer, and file infector. Documented by Doctor… Delivered by PolitePaul service Go to gbhackers.com
-
Zimbra Releases Security Patch for Stored XSS Vulnerability in Classic Web Client
Zimbra Releases Security Patch for Stored XSS Vulnerability in Classic Web Client Zimbra has released its Daffodil v10.1.19 patch update, addressing a stored cross-site scripting (XSS) vulnerability in the platform’s Classic Web Client. The security issue… Delivered by PolitePaul service Go to gbhackers.com
-
Dell BIOS Flaw Lets Attackers Extract Plaintext Passwords Without Brute Force
Dell BIOS Flaw Lets Attackers Extract Plaintext Passwords Without Brute Force A newly disclosed Dell BIOS password-storage flaw can allow attackers with physical access to recover administrator and user passwords from SPI flash dumps in… Delivered by PolitePaul service Go to gbhackers.com
-
Top 10 Best Cloud Security Providers – 2026 Review
Top 10 Best Cloud Security Providers – 2026 Review As businesses continue to migrate critical applications and data to the cloud, the traditional security perimeter has dissolved. The responsibility for securing these dynamic,… Delivered by PolitePaul service Go to gbhackers.com
-
‘Ghostcommit’ hides prompt injection in images to fool AI agents, steal secrets
‘Ghostcommit’ hides prompt injection in images to fool AI agents, steal secrets A PNG hiding a prompt injection could steal your repo’s secrets, researchers demonstrate. The technique, dubbed ‘Ghostcommit,’ slipped past AI code reviewers CodeRabbit and Bugbot, which never open image files at all, then convinced a coding agent to read a repo’s .env and…
-
New U-Boot flaws could enable stealthy firmware attacks
New U-Boot flaws could enable stealthy firmware attacks Six vulnerabilities in the widely used U-Boot bootloader have been discovered that could allow attackers to execute malicious code during device boot, potentially enabling stealthy firmware attacks that compromise security protections and install persistent malware. […] Lawrence Abrams Go to bleepingcomputer
-
Ryuk ransomware member pleads guilty in the US, faces 15 years in prison
Ryuk ransomware member pleads guilty in the US, faces 15 years in prison A 34-year-old Armenian man has pleaded guilty to hacking U.S. companies and deploying the infamous Ryuk ransomware to encrypt their systems. […] Bill Toulas Go to bleepingcomputer
-
Police suspects Dutch hackers were involved in Odido breach
Police suspects Dutch hackers were involved in Odido breach The Dutch National Police (Politie) says it has found “strong indications” that Dutch hackers have been involved in a February breach at the telecommunications provider Odido. […] Sergiu Gatlan Go to bleepingcomputer
-
Progress urges ShareFile admins to shut down servers over “credible” threat
Progress urges ShareFile admins to shut down servers over “credible” threat Progress Software is emailing ShareFile customers who use Storage Zone Controllers to immediately shut down their servers after identifying what it describes as a “credible external security threat” targeting the on-premises secure file-sharing software. […] Lawrence Abrams Go to bleepingcomputer
-
Forg365 Phishing Platform Using AI to Attack Microsoft 365 Accounts
Forg365 Phishing Platform Using AI to Attack Microsoft 365 Accounts Forg365 is a phishing-as-a-service platform that targets Microsoft accounts, combining AI-powered phishing, session theft, and post-compromise mailbox access in a single operator panel The platform is reportedly distributed through Telegram, where criminals can access a 30-day trial, pay about per month, or choose an annual…
-
CISA Details “Lessons from a Cyber Incident” After AWS GovCloud Credentials Leak
CISA Details “Lessons from a Cyber Incident” After AWS GovCloud Credentials Leak CISA has published a candid after-action account revealing that a contractor accidentally exposed the agency’s own AWS GovCloud credentials and Infrastructure-as-Code repositories in a personal, public GitHub account, triggering an internal incident response and a rare public “lessons learned” disclosure from the federal…