tag:blogger.com,1999:blog-48028414786341472762026-09-12T21:24:45.724+05:30The Hacker News has been internationally recognized as a leading news source dedicated to promoting awareness for security experts and hackersUnknownnoreply@blogger.comBlogger17251125tag:blogger.com,1999:blog-4802841478634147276.post-21626890536931833432026-09-12T21:24:45.724+05:302026-09-12T21:24:45.724+05:30

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. Details of the vulnerabilities are as follows - CVE-2026-42016 (CVSS score: 8.1) - An incorrect authorization

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-55511723371092207752026-09-12T15:54:44.780+05:302026-09-12T15:54:44.780+05:30

Over the past year, we watched a new class of alert appear in enterprise security operations centers and grow faster than anything else in the stream: alerts that were triggered by AI tools and agents. Not attacks against AI, but the ordinary, everyday footprint of an organization using it, from developers running coding agents and non-technical staff signing consumer AI tools into corporate

Unknownnoreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-90094286085896870122026-09-12T14:37:56.004+05:302026-09-12T15:07:09.453+05:30

The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. On May 12, Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, disclosed details of a coordinated cyber attack that targeted the package manager for the

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-82072612693495752982026-09-11T22:00:18.938+05:302026-09-12T15:07:28.335+05:30

GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure. The vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository commits API that could allow an unauthenticated user to read arbitrary files from the GitLab server under

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-26297693901102215422026-09-11T21:45:29.532+05:302026-09-12T14:23:38.384+05:30

Anthropic on Thursday said it identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, including Alibaba, Moonshot, DeepSeek, Z.ai (aka Zhipu), and MiniMax. Knowledge distillation by itself is a legitimate training method. It refers to a machine learning technique where a large, powerful AI model assumes the role of a "teacher" to

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-79357389965094973632026-09-11T19:59:47.654+05:302026-09-11T21:35:23.474+05:30

Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026. The threat actors, which the artificial intelligence (AI) company has branded Generative Threat Groups (GTGs), span state-sponsored groups, financially motivated criminals, commercial

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-65653715545615427112026-09-11T19:40:20.708+05:302026-09-11T21:35:40.525+05:30

Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve. The operation has been attributed to a cyber espionage group it calls GTG-20006 (where "GTG" stands for Generative Threat Group), which aligns with broader reporting linking the cluster to Midnight

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-2179168372999828142026-09-11T17:00:00.000+05:302026-09-11T17:00:00.317+05:30

Security teams have become exceptionally talented at finding vulnerabilities. Now, it’s time to turn our attention to optimizing the process for determining which of those vulnerabilities actually create a path to compromise. A critical vulnerability may look alarming on a scanner report, but if it sits behind strong segmentation, identity controls, and other defenses that prevent an attacker

Unknownnoreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-5611020340282064762026-09-11T13:01:05.301+05:302026-09-11T13:01:05.301+05:30

Attackers have chained two flaws in JFrog Artifactory, the repository that software build pipelines pull from, to take administrator control of self-hosted servers and plant backdoors, cloud security company Wiz said in a report. Wiz saw the attacks between August 15 and September 8. JFrog had fixed both flaws before then, so only servers that had not been updated were open to them.

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-26698613402595445232026-09-11T12:44:09.735+05:302026-09-11T12:44:09.735+05:30

A China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims' computers, security company Gen Digital said in research published Thursday. The attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do. Tencent, which owns

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-63996878261748540812026-09-11T12:16:18.155+05:302026-09-11T12:16:18.155+05:30

PaperCut on Thursday released a new security maintenance release that replaces all previously published emergency patches that were pushed to address two security flaws that have come under active exploitation. The software development company said PaperCut NG/MF versions 26.0.5, 25.0.13 and 24.1.10 are now available for customers to download. "These are Regular Maintenance Releases (MR) that

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-55965008081310000442026-09-11T11:49:59.778+05:302026-09-11T11:49:59.779+05:30

Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated, remote attacker to bypass

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-20121668579136092492026-09-10T23:17:38.366+05:302026-09-11T11:56:12.651+05:30

A lot of this week’s security news has the same awkward answer to one question: “Why was that allowed to work?” An extension asks for access and takes too much. A trusted service becomes part of a phishing chain. An old bug still gets results. An exposed system stays exposed. A package looks useful right up until it isn’t. Different stories, same basic problem: the path in was often already

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-63436134468891599092026-09-10T20:06:47.405+05:302026-09-10T20:06:47.405+05:30

Bad actors are misusing Google Play's Early Access program to push deceptive apps that claim to offer money, rewards, casino winnings, and premium content. Early Access apps are apps that haven't been released on the official Android app marketplace. The main idea behind the program is for developers to solicit user feedback for new applications or features they may be working on before their

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-83858627545188974632026-09-10T17:15:05.997+05:302026-09-10T17:15:05.997+05:30

Check Point has patched two critical vulnerabilities in the way its firewall and management products handle VPN certificates. The company says both could allow an unauthenticated remote attacker to run code, but only "under specific conditions" that it has not described. One flaw affects Check Point's Security Gateways, its firewall appliances. The other affects those gateways and the Security

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-31202412372792915082026-09-10T17:11:53.824+05:302026-09-10T20:53:00.122+05:30

A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence (AI) to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF and break into hundreds of instances. According to independent reports from Blackpoint Cyber and GreyNoise, the activity originates from "45.142.193[.]132," an IP address that has been linked to

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-20212915156731846792026-09-10T17:03:43.212+05:302026-09-10T17:03:43.213+05:30

The Gigabud banking trojan now installs a second Android app that creates a work profile on an infected phone and drops a tampered banking app inside it, security firm Group-IB said in a report published on September 9. A work profile is a separate space that Android typically reserves for employer apps, and what's inside it is kept separate from everything in the personal space. That

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-62082810385661375072026-09-10T16:06:46.954+05:302026-09-11T11:26:26.816+05:30

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet, to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026. The vulnerabilities are listed below - CVE-2026-20079 (CVSS score: 10.0) - An authentication

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-82464119684759050832026-09-10T12:42:55.229+05:302026-09-10T12:43:24.880+05:30

Nearly one in ten of the internet-facing LiteLLM servers that Wiz Research scanned in February accepted sk-1234, the example admin key in LiteLLM's own setup guide. LiteLLM is an open-source AI gateway, the software a company puts between its applications and the model providers it pays for. That key is the gateway's administrator credential. Anyone who holds it can read every

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-31233771991535591062026-09-10T12:34:01.972+05:302026-09-10T20:53:36.540+05:30

Anthropic on Wednesday disclosed a fourth incident in which its artificial intelligence (AI) model broke into real third-party systems, marking the latest in a growing list of cases that have raised concerns about the security risks posed by autonomous AI agents. The AI company said the incident dates back to January 2026 and involved an early version of Claude Opus 4.6 that breached "

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-9684030250240140182026-09-09T23:56:05.514+05:302026-09-10T20:53:51.086+05:30

The U.S. Department of Justice (DoJ) on Wednesday announced coordinated actions aimed at an illicit online marketplace called Xinbi Guarantee that offered scam services, including seizing Telegram channels used to run the service, confiscating two cryptocurrency wallets, and deploying the Scam Center Strike Force to Madagascar to help disrupt 13 scam compounds run by Chinese organized crime

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-82151375753461115952026-09-09T22:04:05.815+05:302026-09-10T12:10:35.003+05:30

Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31 (aka Bronze Vinewood, Judgement Panda, JungleBamboo,

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-58849721365063079382026-09-09T19:53:55.520+05:302026-09-09T23:23:28.459+05:30

Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create "stolen keys" that grant illicit access to tools from model providers like Google, Anthropic, and others.  Information stealers like Lumma Stealer or Vidar are equipped to harvest a wide range of data from compromised systems. This can include credential, session tokens, and API

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-69849968245375177292026-09-09T17:27:36.604+05:302026-09-09T17:27:36.605+05:30

A major vulnerability is disclosed. The alert lands immediately. Then comes the harder question: Are we actually exposed? For many security teams, answering that means jumping between vulnerability scanners, endpoint tools, cloud inventories, SBOMs, repositories, and application data to build enough context to act. As AI accelerates vulnerability discovery and research, that delay matters more

Unknownnoreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-35259999569973431612026-09-09T16:47:07.239+05:302026-09-09T16:47:07.240+05:30

A flaw in DeepSeek Harness, DeepSeek's open-source tool for running AI coding agents on a developer's machine, let a sandboxed agent turn off its own sandbox with a single command. The tool runs an agent's commands inside an operating-system sandbox, so that an agent working on untrusted files cannot write outside its workspace. The agent could remove that limit by calling the tool's own web

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.com