Recently active topics

Ravie Lakshmanan Jul 20, 2026  Cybersecurity / Hacking A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools.The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery. Some bugs were new. Others were already being used before defenders had time to patch.Here is the full recap of what broke, what was exploited, and what needs attention now.⚡ Threat of the WeekNew wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code - Searchlight Cyber disclosed a pre-authenticated remote code execution vulnerability in WordPress Core that can be exploited anonymously on a standard WordPress installation, without requiring any plugins or other special conditions. It is a combination of CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection in WordPress core) that can be chained to turn an an

OpenText Server Backup Cloud DR Prerequisites This prerequisites are required before attempted a Cloud DR recover or a Test.This document describes the minimum prerequisites and step‑by‑step configuration required to perform the OpenText Server Backup DR SaaS AWS EC2 Recovery Test. It includes AWS Access Key creation, an IAM policy template, an EC2 role configuration, and instructions for enabling VPN split tunnel so internet access is retained to the Recorverd VM and the AWS Console during testing.1. Create AWS Access Keys (Only required if policy does not exist)ObjectiveCreate an AWS Access Key ID and Secret Access Key to enable programmatic access (AWS CLI, SDKs, or third‑party tools).ProcedureSign in to the AWS Console and open IAM. Go to Users. Select the intended IAM user. Open the Security credentials tab. Under Access keys, click Create access key. Select the appropriate use case (for example: AWS CLI, application running outside AWS). Click Next. Optionally add a description t

CVEs have been published or revised in the Security Update GuideJuly 3, 2026These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:CVE-2026-13774 Title: Chromium: CVE-2026-13774 Use after free in Extensions Version: 1.0 Reason for revision: Information published. Originally released: July 3, 2026 Last updated: July 3, 2026 Aggregate CVE severity rating: Customer action required: YesCVE-2026-13775 Title: Chromium: CVE-2026-13775 Use after free in GPU Version: 1.0 Reason for revision: Information published. Originally released: July 3, 2026 Last updated: July 3, 2026 Aggregate CVE severity rating: Customer action required: YesCVE-2026-13776 Title: Chromium: CVE-2026-13776 Type Confusion in Dawn Version: 1.0 Reason for revision: Information published. Originally released: July 3, 2026 Last updated: July 3, 2026 Aggregate CVE severity rating: Customer action required: YesCVE-2026-13779 Title: Chromium: CVE-2026-13779 Use

No info at this time only  Version 150.0.4078.80  https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security Webroot SecureAnywhere users make sure to re-add back in the Privacy Protection area after every update. Click on GIF to see full size!  

The new macOS malware has targeted at least 100 users to steal their passwords and cryptocurrency.  July 16, 2026 By Eduard Kovacs A new macOS malware named ClickLock Stealer leverages social engineering and process killing to bypass the operating system’s protections and obtain valuable information from victims. Cybersecurity firm Group-IB came across ClickLock Stealer in early June, and the malware appears to have been around since at least late May. Researchers say it has targeted at least 100 users across 33 countries, more than half in Europe.The stealer is designed to collect various types of data from compromised systems, including web browsers, cryptocurrency wallets and wallet extensions, and password manager extensions. It can also harvest blockchain addresses from six chains and target the macOS Keychain, FTP credentials, and shell history. The stolen data is added to an archive file and exfiltrated to a Telegram bot.While Group-IB researchers could not definitively determin

When chained together, the two vulnerabilities allow threat actors to gain root-level capabilities on SonicWall's mobile access appliances. July 17, 2026 By Nate Nelson Source: PM Images via Getty ImagesTwo newly reported vulnerabilities in SonicWall's Secure Mobile Access (SMA) appliances have been exploited as zero-days by a major ransomware group.On July 14, the cybersecurity vendor SonicWall published a security advisory regarding two vulnerabilities in its SMA 1000 Series appliances, CVE-2026-15409 and CVE-2026-15410. Together they could allow any random, unauthenticated attacker to gain remote code execution (RCE) powers and then run commands on the box at the root level.Indeed, this is already happening. According to telemetry from Rapid7, a threat actor connected to the infamous Inc ransomware-as-a-service (RaaS) group has been using CVE-2026-15409 and CVE-2026-15410 as zero-days, burrowing into multiple enterprise networks, sweeping up credentials, and setting the stage for ra

July 17, 2026 By Sergiu Gatlan A security researcher using the "Nightmare Eclipse" handle has released a Windows zero-day exploit dubbed LegacyHive that allows attackers to escalate privileges on up-to-date Windows systems.Nightmare Eclipse published a proof-of-concept (PoC) exploit hours after Microsoft released its July 2026 Patch Tuesday updates, saying that it abuses a security vulnerability in the Windows User Profile Service, which has yet to receive a CVE ID for easier tracking.However, unlike previous exploits released by NightmwareEclipse, the LegacyHive PoC has been modified to require additional credentials, making it harder for attackers to weaponize the vulnerability."The PoC requires another standard user credentials and a third username (which can be an administrator account), if the PoC is successful, it will end up mounting the target user hive in current user classes root," the researcher said. >>Full Article<<

July 17, 2026 By Pierluigi Paganini  A cyberattack hit one of Japan’s largest food companies, Nichirei, disrupting logistics and shipments. The company is gradually restoring operations.Nichirei is one of Japan’s largest food companies, best known for its frozen food business. Founded in 1942 and headquartered in Tokyo, it operates globally through dozens of subsidiaries.The food giant confirmed that the system outage reported on July 13 resulted from a cyberattack targeting its servers. The company immediately set up an emergency response team to investigate the incident and coordinate recovery efforts.To reduce the risk of further attacks, Nichirei is withholding technical details about the breach while it continues to restore affected systems and assess the full impact. >>Full Article<<

July 17, 2026 By Bill Toulas Ernst & Young is notifying customers of a data breach caused by the compromise of a third-party support ticket system used by its IT personnel.According to the company, support tickets submitted through the platform may have included documents containing client tax information.Ernst & Young (EY) is among the world’s four largest auditing and professional services providers, offering auditing, tax, consulting, and transaction advisory services to major organizations in more than 150 countries.The company employs 406,000 people and reported a global revenue of $53.2 billion last year.The breach notification to affected clients states that Ernst & Young detected anomalous activity on its networks on April 23 and initiated an investigation.With help from external cybersecurity experts, the company determined that an unauthorized third party had accessed the said platform between March 28 and April 12 and downloaded multiple documents.The affected in

July 17, 2026 By Ravie Lakshmanan Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack.The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil, which was observed using an "unprecedented" four-tier blockchain-based command-and-control (C2) infrastructure spanning Tron, Aptos, and Binance Smart Chain to deliver a remote access trojan (RAT) capable reverse shell, credential harvesting, file exfiltration, and persistent backdoor injection."This tactic makes disabling or destroying the C2 infrastructure extremely difficult," Checkmarx researcher Pavan Gudimalla said in an analysis published last month. The activity has been attributed to a threat actor named SuccessKey, with evidence of malicious activity detected as far back as February 27, 2026, when cryptocurrency wallets linked to ViteVenom were activated.While the typosquats p

 July 17, 2026 By Pieter Arntz Shark’s cloud-connected robot vacuums are currently exposed by an unpatched AWS (Amazon Web Services) IoT (Internet of Things) policy flaw that could turn one compromised device into a remote-control skeleton key for many others in the same region, with access to cameras, maps, and Wi‑Fi passwords.A researcher using the handle tokay0 took apart a Shark RV2320EDUS robot vacuum and found that its embedded AWS IoT certificate is allowed to publish and subscribe to topics for any Shark device in the same AWS Region, not just itself.An AWS Region is a distinct geographical location where Amazon clusters its cloud data centers. Each AWS Region is completely isolated from the others. There are currently 39 AWS Regions worldwide.By design, AWS provides per-device “shadows” that store state such as configuration and commands. However, Shark’s overly permissive Message Queuing Telemetry Transport (MQTT) policy lets a stolen certificate talk to other vacuums’ shadow

July 17, 2026 By Pierluigi Paganini Russian-speaking UAT-11795 spreads trojanized Zoom, Webex, and MobaXterm installers to deliver Starland RAT and the WLDR memory-only implant.Cisco Talos researchers published a detailed technical report on July 16 disclosing UAT-11795, a financially motivated, Russian-speaking threat actor that has been running a malware campaign against users in the United States and Europe since at least June 2025. The operation distributes trojanized installers for software that IT professionals and developers actually use: MobaXterm, Cisco Webex, Zoom, DBeaver, and even the gaming platform FACEIT.“Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.” reads the report published by Talos.The wide range of targets, from developer tools and business collaboration software to gaming platforms, suggests the at

July 17, 2026 By Sinisa Markovic A previously unknown ransomware strain called Spirals was used last month in an attack against an IT services company in South Asia, where attackers went from initial access to data theft and encrypting the network in less than 24 hours, according to Symantec’s Threat Hunter Team.Spirals encrypts files quickly after gaining a footholdSpirals is written in Rust and encrypts files using a separate AES-128 key per file, each wrapped with an attacker-controlled ECDH P-256 public key. To speed up encryption, files larger than 5 MB are encrypted in chunks.Victims were left with a ransom note, RECOVERY_SECTION.log, directing them to a Tor negotiation site and threatening to leak stolen data within six days if no payment was made.The attackers gained initial access by compromising an internet-facing IIS web server and uploading an ASP.NET web shell. From there, they ran commands through the IIS worker process to open an interactive session, escalating privilege

July 17, 2026 By Bill Toulas A vulnerability dubbed HollowByte allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on OpenSSL servers with a malicious payload of just 11 bytes.The OpenSSL team has silently fixed the vulnerability (no identifier assigned) and backported the patch to older releases.Because the OpenSSL software is the foundational backbone for secure internet communication, organizations should prioritize switching to a fixed version of the library.HollowByte detailsIn an advisory earlier this week, Okta’s Red Team described how the HollowByte DoS vulnerability works and its impact in a real-world scenario.The researchers explain that in a TLS handshake, each message has a 4-byte header for declaring the size of the incoming message. However, vulnerable OpenSSL versions allocate the declared length before receiving the payload and checking its size.Every TLS handshake message begins with a 4-byte handshake header, where a three-byte length fiel

Thursday, July 16, 2026The Stable channel has been updated to 150.0.7871.128/.129 for Windows and Mac and 150.0.7871.128 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and RewardsNote: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.This update includes 7 security fixes. Please see the Chrome Security Page for more information. https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html Webroot SecureAnywhere users make sure to re-add back to Privacy Protection!   

July 16, 2026 By Lawrence Abrams The Coca-Cola Company disclosed today that a ransomware attack impacting its Fairlife dairy subsidiary has disrupted operations, temporarily suspending production of Fairlife products across the United States.In a Form 8-K filing with the U.S. Securities and Exchange Commission (SEC), Coca-Cola said Fairlife detected unauthorized access to some of its systems, including its production-related systems, in connection with a ransomware attack."After detecting the issue, the Company promptly activated its incident response and business continuity protocols," Coca-Cola said in the filing."The Company's investigation and assessment of the impact of the incident is ongoing, with the assistance of outside advisors and cybersecurity experts. The Company has also notified law enforcement."The company said product quality and safety have not been affected by the ransomware attack. >>Full Article<<

The social-engineering technique has primarily been a tool of financially motivated criminals.Dan Goodin – 16 Jul 2026 One of the Russian government’s most elite hacking groups has adopted an attack, known as Clickfix, to compromise devices belonging to sensitive organizations in Ukraine, the latter country’s CERT center is warning.Clickfix has emerged as an effective attack technique that attackers, primarily financially motivated criminals, began using in the last year or so. Websites under the control of the attackers display a CAPTCHA that requires the visitor to copy a jumble of text and paste it into the terminal. The text contains scripts that, once entered, perform malicious actions, typically by installing malware or exfiltrating sensitive data. Ukraine’s CERT said Wednesday that Sandworm, an advanced hacking unit inside the GRU, Russia’s military intelligence arm, is now using the technique.“GhettoVibe,” “ScoutCurl,” and many moreThe Clickfix attacks began in the spring and h

July 16, 2026 By Sinisa Markovic A Russian-speaking threat actor known as “bandcampro” used a jailbroken Gemini CLI, Google’s open-source terminal-based AI agent, to deploy and operate a small command-and-control (C2) botnet, according to TrendAI. Operational overview (Source: TrendAI)In more than 200 sessions between March 19 and April 21, 2026, the threat actor worked with Gemini to deploy and operate infrastructure that controlled eight computers inside a dental clinic and gain access to the clinic’s OpenDental database.Posing as an “authorized penetration tester,” he instructed Gemini to suppress safety disclaimers and automatically save any credentials it encountered. Both instructions were placed in Gemini’s memory file, which reloads at the start of each session, allowing them to persist across subsequent conversations. >>Full Article<<

July 16, 2026 By Pieter Arntz Flock-style ALPR systems carry serious privacy and civil-liberties risks, and the backlash is now starting to show up in agency decisions too.For those not yet familiar with Flock, Flock Safety operates an automated license plate recognition (ALPR) system that uses cameras and computer vision to identify and log vehicle license plates.According to ACLU.org, in the US there are currently:“80,000–100,000 Flock cameras in both urban and rural areas on highways, in neighborhoods, and outside your local hardware store.”Automated license plate readers were sold as a crime-fighting tool, but growing evidence suggests the privacy and accountability problems surrounding Flock are becoming increasingly difficult to dismiss. A growing number of incidents now show the same pattern: broad surveillance, shaky oversight, and enough operational risk to create real harm for ordinary people.ALPR systems create durable location records about people who are not suspected of a

July 16, 2026 By Lawrence Abrams A flaw in Anthropic's Claude for Chrome browser extension could allow a malicious extension to trigger predefined AI actions by simulating user clicks, potentially allowing it to abuse Claude's access to connected services such as Gmail, Google Docs, Google Calendar, and Salesforce.The issue was discovered by Ax Sharma of Manifold Security, who says it stems from how the Claude extension determines whether a user intentionally requested one of its built-in tasks.Chrome extensions with permission to run on a website can inject JavaScript into the page, allowing them to read and modify its contents. This includes changing page elements, reading information displayed on a site, and generating click and keyboard events programmatically.According to Manifold's report, the Claude extension listens for click events on a specific page element that launches one of its built-in AI workflows. These workflows are predefined tasks that allow Claude to perform action

Iberian hackers carried out a variety of cyberattacks and laundered the winnings through complex financial networks. July 16, 2026 By Nate Nelson Source: Gwengoat via Getty ImagesLaw enforcement agents across three countries and one ocean have disrupted a Spanish cybercrime network and its sophisticated money laundering apparatus.On July 13, Spain's national police revealed a World Cup semifinal-level takedown of an Iberian criminal gang. The gang employed more than 70 known individuals, in possession of 19 registered companies and nearly 1,000 financial accounts.Most of those individuals were used to launder cybercrime profits. The hackers at the heart of this operation worked out of two "nerve centers," perpetrating man-in-the-middle (MitM) attacks, CEO impersonation scams, social engineering attacks involving fake invoices, and scams built off fake investment platforms. In all, they managed to steal at least €140 million ($161 million). Authorities tied €61 million of their take to

 July 16, 2026 By Pierluigi Paganini  TuxBot v3, an AI-built IoT botnet for 17 architectures, shipped with LLM bugs and safety disclaimers the developer never removed.Palo Alto Networks’ Unit 42 identified a previously undocumented modular IoT botnet framework called TuxBot v3 Evolution, and it comes with an unusual detail: the developer used a large language model to write significant portions of the code, and the LLM’s safety disclaimer ended up in every compiled binary. Sixty-one C source files each carry an identical header warning that “this code is for educational and authorized security research only.” The developer shipped it without removing a single line.“The malware authors leveraged an LLM to assist in their code development, yielding mixed results. While the AI complied with their request to generate botnet code, it included a safety disclaimer that the developer failed to remove before shipping.” reads the Unit 42’s report. “Although the LLM clearly aided in constructing