tag:blogger.com,1999:blog-48028414786341472762026-07-30T15:19:07.717+05:30The Hacker News has been internationally recognized as a leading news source dedicated to promoting awareness for security experts and hackersUnknownnoreply@blogger.comBlogger16908125tag:blogger.com,1999:blog-4802841478634147276.post-30980788479941398372026-07-30T15:01:21.460+05:302026-07-30T15:03:04.235+05:30

South Korean authorities and four security firms have disclosed a state-sponsored campaign that compromised trusted domestic websites. The attackers used those sites to exploit locally installed financial-security software and infect targeted visitors with SIGNBT or COPPERHEDGE backdoors. A compromised page could infect a system running a vulnerable AnySign4PC version without a prompt or

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-47323474861360301502026-07-30T13:10:48.390+05:302026-07-30T13:10:48.390+05:30

The Russian threat actors recently linked to the exploitation of a now-patched vulnerability in Zimbra have been observed exploiting another vulnerability, this time in Microsoft Outlook Web Access (OWA), to target U.S. and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors. The activity, which began on July 22, 2026, involves the

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-2304568561841948222026-07-30T12:58:43.796+05:302026-07-30T12:58:43.797+05:30

The Federal Communications Commission (FCC) added foreign-produced mobile robots and networked power inverters to its Covered List on July 28. The move generally prevents new models from receiving the equipment authorization required for import, marketing, or sale in the US. Previously authorized models can still be sold, and devices people already own are unaffected. Federal purchases and use

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-39785457854772615292026-07-30T11:35:17.893+05:302026-07-30T13:28:40.662+05:30

Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than 2 billion weekly downloads between them. The original Aikido and Wiz reports did not attribute the

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-57036221998820497612026-07-30T10:38:39.165+05:302026-07-30T10:38:39.165+05:30

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a newly disclosed security flaw impacting Cisco Secure Firewall Management Center (FMC) Software to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation. The vulnerability, assigned CVE-2026-20316 (CVSS score: 5.3), could permit an unauthenticated, remote attacker to log

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-47692534132102937362026-07-29T23:40:00.590+05:302026-07-30T09:09:41.137+05:30

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-21620950049706930122026-07-29T21:09:30.222+05:302026-07-29T21:09:30.222+05:30

Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-59726 (CVSS score: 10.0), impacts all versions of the project before version 3.16.3. It has been codenamed RufRoot by Noma Security's

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-66177023814992744362026-07-29T21:01:15.061+05:302026-07-30T10:22:17.756+05:30

Broadcom has released security updates to address multiple security flaws impacting VMware ESX, vCenter, Workstation, and Fusion, three of which have been designated as critical in severity. The first of the three critical-rated flaws is CVE-2026-59309 (CVSS score: 9.8), which has been described as an authentication bypass in VMware vCenter. "A malicious actor with network access to vCenter

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-34774808667747377542026-07-29T19:18:36.578+05:302026-07-29T20:34:10.683+05:30

A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27, triggering a statewide cybersecurity response. Braham, Plymouth, South St. Paul and Maple Plain have publicly described a plant outage, communications failures or affected automated controls. Braham's water plant went offline, and the city asked residents to minimize

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-79866042761010259782026-07-29T19:12:57.911+05:302026-07-29T20:32:46.482+05:30

Cybersecurity researchers have disclosed details of a large-scale fraud campaign that involves creating lookalike websites of major Russian companies with an aim to siphon funds from international firms for more than nine years. According to Russian cybersecurity vendor F6, the threat actors have set up clone websites of Russian companies across fertilizer manufacturers, petrochemical companies

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-10579428794310041842026-07-29T17:45:00.000+05:302026-07-29T17:45:00.111+05:30

AI is compressing exploit timelines. The real question isn't whether your vulnerability management playbook needs to change, it's which part of it you've been getting wrong all along. The conversation happening in security circles right now goes something like this: Mythos is here. Exploit timelines are collapsing. Does the vulnerability management playbook need to change? The honest answer is

Unknownnoreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-59926390439676050032026-07-29T17:27:00.839+05:302026-07-29T17:27:00.839+05:30

Nebula Security says a patched Firefox JIT flaw could be triggered by simply visiting a malicious webpage and was also used to compromise Tor Browser. Tracked as CVE-2026-10702, the bug provides arbitrary code execution inside the browser's renderer process. Mozilla rated it High and fixed it in the Firefox 151.0.3 update. "No settings or additional user interaction are required," Eten Zou,

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-64445769341311870012026-07-29T16:43:10.461+05:302026-07-29T16:59:48.561+05:30

Most organizations have incident response plans, security tools, and technical teams in place. Yet new research suggests that many still lack the coordination, visibility, and executive alignment needed to withstand a serious cyberattack. According to The State of Incident Response Readiness 2026, based on a survey of 600 senior IT security decision makers conducted by Vanson Bourne in January

Unknownnoreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-17132237092517035542026-07-29T16:30:00.666+05:302026-07-29T16:30:00.666+05:30

The Federal Security Service of the Russian Federation (FSB) on Wednesday said it charged Telegram founder Pavel Durov for allegedly facilitating terrorist activities and for failing to remove prohibited information in violation of Russian law. The principal security agency said the instant messaging platform "failed to remove numerous channels, chats, and bots on the platform that are

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-59939419503594179302026-07-29T14:28:27.032+05:302026-07-29T14:29:22.499+05:30

Cybersecurity researchers have shared additional technical details about a recently patched critical security flaw impacting Check Point Security Management Server and Multi-Domain Security Management Server (MDS) that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-16232 (CVSS score: 9.3), is an authentication bypass in the SmartConsole login process that

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-41658828555208120362026-07-29T13:21:00.379+05:302026-07-29T14:02:46.056+05:30

OpenAI on Tuesday revealed the rogue artificial intelligence (AI) agent that escaped its sealed evaluation environment and broke into Hugging Face's production environment also hacked multiple third-party accounts and services as part of the attack. The latest disclosure shows that the security incident, which stemmed from an internal security test, was more extensive in scope than previously

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-26066750547781972532026-07-29T13:17:19.059+05:302026-07-29T13:18:02.474+05:30

Gitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A user with ordinary repository write access can turn attacker-controlled patch content into a live Git hook and run shell commands as the Gitea service account. Tracked as CVE-2026-60004 (CVSS score: 9.8), the flaw affects Gitea versions 1.17 and later before 1.27.1 and is fixed in 1.27.1. The

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-76393113149987421272026-07-29T12:37:23.972+05:302026-07-29T12:37:23.972+05:30

Source code for the Flying Eagle Android remote access trojan (RAT) framework is circulating through criminal Telegram channels. Hunt.io and independent researcher NetAskari traced matching control panels and certificates to 170 internet servers. They linked the framework to a fake "公安一网通办" Public Security service application targeting Android users in China. The kit supports payment-password

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-13003508327964487152026-07-29T09:50:57.127+05:302026-07-29T09:51:17.302+05:30

Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan (RAT) associated with the DEV#POPPER malware family. The list of affected packages is as follows - @joyfill/layouts@0.1.2-2773.beta.0 @joyfill/components@4.0.0-rc24-2773-beta.4 The two packages "contain an import-time JavaScript implant that resolves encrypted code

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-45190522991945019462026-07-29T00:29:07.348+05:302026-07-29T22:48:41.034+05:30

Anthropic says Claude Mythos Preview helped derive an end-to-end key-recovery attack against HAWK-256 and a 200- to 800-fold speedup for an attack on seven-round AES-128. The HAWK attack exploits a previously unused symmetry in the lattice behind the signature scheme. Anthropic's released implementation gives an expected end-to-end runtime of about three hours and 42 minutes on a 96-core server

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-61996386102850225152026-07-28T20:31:33.764+05:302026-07-28T20:31:33.764+05:30

A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. If that happens, Tengu's other persistence mechanisms get another chance to relaunch it. Nozomi Networks Labs observed the dropper reaching its honeypots through Telnet credential brute force. Tengu supports 25 distributed denial-of-service (

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-37647774378518309572026-07-28T20:11:36.191+05:302026-07-28T20:11:36.191+05:30

Cybersecurity researchers have sounded an alert after finding more than 36,000 Baseboard Management Controller (BMC) management interfaces exposing Intelligent Platform Management Interface (IPMI) protocol to the public internet. Of the 36,872 internet-exposed server-management interfaces running IPMI, 24,650 have been found to disclose password-derived authentication hashes before login due to

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-21574863066976802672026-07-28T19:03:47.123+05:302026-07-30T09:24:28.575+05:30

JFrog has confirmed that OpenAI models exploited a zero-day in self-hosted Artifactory while trying to reach the open internet from a sealed evaluation environment. Artifactory is JFrog's software repository manager. OpenAI says the models then escalated privileges and moved laterally until they reached an internet-connected node. JFrog says it has since developed and released fixes for cloud

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-58453773951108520482026-07-28T18:26:14.464+05:302026-07-28T18:40:44.795+05:30

OpenWrt has shipped version 24.10.8 to close a critical DHCPv6 stack overflow and a wider set of remotely triggerable flaws in network services enabled by default. The critical issue, tracked as CVE-2026-53921 and rated 9.8 on CVSS 3.1 in OpenWrt's GitHub advisory, lets an unauthenticated attacker able to reach the DHCPv6 server overwrite a stack buffer in odhcpd through a crafted DHCPv6

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-19085614388848844602026-07-28T17:25:20.341+05:302026-07-28T17:25:20.341+05:30

The Iranian state-backed hacking group tracked as Nimbus Manticore (aka GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549) has been attributed to a fresh set of attacks targeting entities across the Middle East, Africa, and South Asia. The intrusions involve the use of a previously undocumented Windows backdoor called NightLedger and two custom WebSocket tunnelers,

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.com