tag:blogger.com,1999:blog-48028414786341472762026-08-23T22:11:20.456+05:30The Hacker News has been internationally recognized as a leading news source dedicated to promoting awareness for security experts and hackersUnknownnoreply@blogger.comBlogger17090125tag:blogger.com,1999:blog-4802841478634147276.post-90462700931702929962026-08-22T20:02:41.442+05:302026-08-22T20:02:41.442+05:30

The U.S. Department of Justice (DoJ) announced on Friday that ByteDance-owned TikTok will pay $400 million to settle a 2024 lawsuit accusing the company of violating child privacy laws in the country. As part of the settlement, the social media platform will pay $300 million immediately, and an additional $100 million "upon entry of an order vacating a prior consent decree entered against

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-91065128711470627052026-08-22T00:23:00.784+05:302026-08-22T00:23:00.784+05:30

Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0. "When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process," TrendAI, Trend Micro's

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-10806980217281427672026-08-21T21:22:10.843+05:302026-08-21T21:22:10.844+05:30

Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine. The driver, BTR.sys (Boot Time Removal Tool), is a

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-17066910258380177172026-08-21T21:11:44.580+05:302026-08-21T21:14:30.130+05:30

Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky, which discovered the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad fraud and creation of a proxy botnet. "The malware spread through the built-in updaters of

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-7980042339344946082026-08-21T16:51:39.213+05:302026-08-21T16:51:39.213+05:30

Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, and support faster decision-making. Cybersecurity has experienced a similar transformation. While attackers employ AI to automate

Unknownnoreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-19011929838674872202026-08-21T15:33:11.724+05:302026-08-21T15:33:11.724+05:30

Cisco has published another round of security updates for Crosswork platforms and Secure Workload Software as part of a continued comprehensive internal security review. Four of the security vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning, regardless of the device configuration. A brief description of each of the flaws is below -

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-50348388001854456022026-08-21T12:34:25.738+05:302026-08-21T12:34:25.739+05:30

A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-19478 (CVSS score: 9.4), a case of code injection that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data under certain conditions without requiring

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-59816374574977933342026-08-21T11:36:11.050+05:302026-08-22T01:26:26.126+05:30

Update: The story was updated after publication to note that the vulnerability has not been exploited. Although the security bulletin originally marked the "Exploited" field under the Exploitability Assessment table as "Yes," on August 21, 2026, Microsoft corrected the "Exploited" status to "No" after The Hacker News contacted the company for comment. It also noted, "this vulnerability was not

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-12210332760123905762026-08-21T01:52:35.781+05:302026-08-21T01:53:57.411+05:30

The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. The affected releases are arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all published from the same owner

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-40650736486784124202026-08-21T01:29:19.146+05:302026-08-21T20:24:29.459+05:30

Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. These clusters include UNC6293, UNC7005, and UNC5976. "These clusters engage in persistent, adaptive

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-46435174994162106222026-08-20T22:53:48.678+05:302026-08-21T11:09:14.347+05:30

A lot of this week’s trouble starts with something trusted doing exactly what it was allowed to do. Signed drivers get turned against defenses. Legitimate apps help malware blend in. A weak header check opens a path to code execution. Elsewhere, exposed systems, old bugs, odd hiding tricks, and AI-assisted exploit research keep lowering the effort needed to cause damage. Nothing here needs

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-12570080715676375312026-08-20T22:29:44.952+05:302026-08-21T11:09:51.545+05:30

The U.S. government on Wednesday warned of an "active threat" targeting critical infrastructure organizations in the country using artificial intelligence (AI)-generated exploit scripts. The activity is targeting Siemens S7 SeriesProgrammable Logic Controllers (PLCs) to conduct reconnaissance and capability development using AI-generated scripts disguised as legitimate monitoring tools. That

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-69430512558979428192026-08-20T20:06:27.502+05:302026-08-20T20:44:15.985+05:30

Adversa AI has disclosed an attack technique that it says can cause xAI's Grok chatbot to send a user's name, approximate location, subscription tier, and the prompts from the ongoing conversation to an attacker-controlled server after the user asks it to summarize an ordinary web page. The AI security company, which has codenamed the technique "Cryptographic Context Injection," said the

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-64163895651767842762026-08-20T19:18:24.200+05:302026-08-20T19:18:24.201+05:30

Cybersecurity researchers have disclosed a critical security flaw in isolated-vm, a popular open-source sandbox with more than 2,900 stars and 190 forks on GitHub, that could allow attackers to escape the confines of the isolated environment. The vulnerability ("GHSA-864f-rcv7-6rh4"), which has yet to be assigned a CVE identifier, impacts all versions of the library before and including 7.0.0.

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-16765163017177630852026-08-20T19:05:13.079+05:302026-08-20T19:05:13.080+05:30

Citrix has released updates to address two security flaws impacting NetScaler ADC and NetScaler Gateway deployments, including a critical-severity authentication bypass vulnerability. According to the cloud computing and virtualization technology company, the issues affect customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds, as well as SecurAccess

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-77527075183838961572026-08-20T18:54:28.708+05:302026-08-22T12:57:29.547+05:30

A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team (CERT Polska). The vulnerability in question is CVE-2026-73570 (CVSS score: 8.9), which refers to a case of command injection that can lead to remote code execution. "A remote code execution vulnerability exists in Zimbra

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-42253417166441929862026-08-20T17:31:24.497+05:302026-08-21T00:00:00.554+05:30

Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale (POS) terminal reads over near-field communication (NFC), without breaking any of the card's cryptography. The attack, which the researchers named "Zombie Card," requires physical

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-85447012873479865572026-08-20T17:15:00.000+05:302026-08-22T14:03:06.417+05:30

In March 2026, an internal AI agent at Meta triggered a “Sev 1” incident after sensitive company and user data was exposed to employees who weren’t authorized to access it.  The incident began when a Meta employee posted a technical question on an internal forum. An engineer used an approved AI agent to analyze it, but the agent posted its response publicly without approval. The employee

Unknownnoreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-34809756846798214652026-08-20T17:09:35.922+05:302026-08-20T17:09:35.922+05:30

Cybersecurity researchers have disclosed two denial-of-service (DoS) attacks that exploit how major content delivery networks (CDNs) convert client-facing HTTP/3 traffic into HTTP/1.1 requests to the websites they front, amplifying a low-bandwidth request stream by up to 350x against the origin server. The attacks, collectively named "CDN Tsunami," were evaluated against Alibaba, Baidu,

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-2174773101705135852026-08-20T16:56:08.173+05:302026-08-21T22:40:26.141+05:30

A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, as well as Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications. "Manic sits at the intersection of Android banking malware and mobile spyware, combining financial-fraud

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-15963346746414624522026-08-20T16:35:11.712+05:302026-08-20T22:50:23.965+05:30

Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The chain, tracked as GHSA-p9r8-2q67-fp86 and rated 9.4 on the CVSS v3.1 scoring system, impacts AIT-GUI

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-70696049968296371952026-08-20T16:08:28.041+05:302026-08-20T16:56:55.201+05:30

Cybersecurity researchers have shed light on an updated version of ToxicPanda (aka TgToxic) that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally. Zimperium zLabs, in a Wednesday report, said the Android malware also features a PIN harvesting workflow targeting more than 140 banking and cryptocurrency applications.

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-40719068147668050702026-08-20T14:12:03.724+05:302026-08-20T14:12:03.724+05:30

A set of 40 Mozilla Firefox extensions has been found to engage in cryptocurrency wallet theft by masquerading as OKX, Rabby Wallet, TronLink, and other Web3 products. According to the Socket Threat Research team, the extensions are part of a broader set of 77 browser add-ons that share source code and infrastructure overlaps. The campaign, dubbed Offside Wallet Theft Factory, is believed to

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-19649539648528550662026-08-20T11:34:34.449+05:302026-08-20T11:34:34.449+05:30

Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution. The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0. It has been described as a case of unrestricted upload of a file with a dangerous type. "The flaw lives in the Forms module's File

Ravie Lakshmananhttp://www.blogger.com/profile/09767675513435997467noreply@blogger.comtag:blogger.com,1999:blog-4802841478634147276.post-16417992918551264282026-08-20T00:32:40.028+05:302026-08-20T00:32:40.028+05:30

Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021. The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers,

Swati Khandelwalhttp://www.blogger.com/profile/06009796704238391750noreply@blogger.com