Tag: cyber
-
Tata Electronics Data Breach Exposes 200,000+ Files Linked to Apple and Tesla, Hackers Claim
Tags: apple, breach, cyber, cybersecurity, dark-web, data, data-breach, group, hacker, ransomware, threatTata Electronics has reported a cybersecurity incident following claims from a ransomware-linked threat group that it has exfiltrated and published over 200,000 files related to Apple and Tesla’s manufacturing operations. The leaked data, which is said to amount to more than 630 GB, has appeared on a dark web portal operated by the >>World Leaks<<…
-
Microsoft Uncovers Parallel Threat Activity From Two Cyberattackers in Single Intrusion
Microsoft’s latest incident write-up shows that a single intrusion can mask two parallel threat activity streams, one tied to Storm-2603 and another to an unknown actor, making the attack far more complex than a conventional ransomware case. The incident began with activity against on-premises SharePoint servers and an attempt to establish internal footholds through exposed…
-
Schwachstellen-Benchmark – GPT-5.5-Cyber von OpenAI übertrifft Claude Mythos 5
Codex Security kann nun automatisiert Schwachstellen analysieren und beheben. Erste Benchmarks sehen das KI-Modell vor Claude Mythos 5. First seen on computerbase.de Jump to article: www.computerbase.de/news/apps/schwachstellen-benchmark-gpt-5-5-cyber-von-openai-uebertrifft-claude-mythos-5.98051
-
Scattered Spider Teens Convicted of TfL Cyber-Attack
Two young British men have pleaded guilty to hacking Transport for London as part of a Scattered Spider plot First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/scattered-spider-teens-convicted/
-
Cybercriminals Abuse TDS Infrastructure to Bypass Firewalls and Hide Malicious Destinations
Cybercriminals are increasingly abusing traffic distribution systems (TDSs) to evade defenses, conceal malicious destinations, and funnel victims into phishing, fraud, and malware campaigns. Once considered a legitimate marketing tool to route visitors to different content or offers, TDS infrastructure is now being repurposed as a stealthy redirection layer that complicates detection and response for network…
-
Critical FFmpeg Vulnerability Lets Hackers Execute Remote Code via Malicious Media Files
A critical memory corruption vulnerability in FFmpeg has been disclosed, allowing for remote code execution through specially crafted media files. This flaw, tracked as CVE-2026-8461 and named “PixelSmash,” affects the MagicYUV decoder within FFmpeg’s libavcodec library and has a CVSS score of 8.8. Discovered by JFrog Security Research, the vulnerability arises from a heap out-of-bounds…
-
Critical libssh2 Vulnerability Lets Remote Attackers Execute Code via Crafted SSH Packets
A critical security vulnerability has been identified in libssh2, a widely used client-side SSH library. This flaw allows remote attackers to execute code by sending specially crafted SSH packets. The vulnerability, tracked as CVE-2026-55200, has a CVSS score of 9.2 and affects libssh2 versions up to and including 1.11.1. The issue has been resolved in…
-
FlutterShell Malware Uses C2-Delivered JavaScript Payloads to Evade Sandbox Detection
Targeted macOS endpoint monitoring, the CL-CRI-1089 cluster tied to Operation FlutterBridge repurposes the Flutter framework to deliver a novel macOS malware family dubbed FlutterShell. Rather than rehashing prior campaign reporting, this piece treats recovered artifacts as a technical detection case study built from static analysis of ten Mach”‘O samples collected between December 2025 and March…
-
Philippine government taps Google Cloud to deploy AI agents
The Filipino government will equip public servants with Gemini Enterprise AI tools, launch a cross-agency cyber defence alliance and upgrade subsea network infrastructure First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366644982/Philippine-government-taps-Google-Cloud-to-deploy-AI-agents
-
CodeStorm Phishing Campaign Targets M365 Tenants With Token Reuse and Replay Attacks
A multi-organization phishing campaign attributed to the CodeStorm family is actively targeting Microsoft 365 tenants with a tenant-aware AiTM (adversary-in-the-middle) phishing kit that combines rotating frontends and backend replay behavior under a stable controller path, /google.php. The human recipient rarely scrolls to that dummy conversation, but automated secure email gateways frequently do; the added “conversation…
-
Two Scattered Spider Hackers Convicted Over Transport for London Cyber Attack
Two alleged members of the notorious Scattered Spider cybercrime collective have pleaded guilty to orchestrating a disruptive cyber attack against Transport for London (TfL). This marks a significant law enforcement victory against a group known for targeting large enterprises and critical infrastructure. The UK National Crime Agency and City of London Police confirmed that Thalha…
-
FortiBleed Campaign Uses FortigateSniffer to Harvest 110 Million Credentials From Fortinet Firewalls
A large-scale credential harvesting campaign called “FortiBleed” has been uncovered, revealing how threat actors are exploiting Fortinet FortiGate firewalls to capture authentication data on an unprecedented scale. Research from the SOCRadar Threat Research Unit (STRU) indicates that this operation has already compromised over 110 million credentials by targeting misconfigured or weakly secured devices, turning them…
-
OpenAI Launches Daybreak to Automate Vulnerability Patching With GPT-5.5-Cyber
OpenAI has announced Daybreak, a new cybersecurity initiative aimed at automating vulnerability patching on a large scale using its latest GPT-5.5-Cyber model. This marks a shift from merely discovering vulnerabilities to focusing on end-to-end remediation. The initiative addresses a growing challenge in the industry, AI-driven tools have greatly accelerated vulnerability identification, leaving organizations struggling to…
-
CalPhishing Campaigns Use Outlook Calendar Invites to Deliver Persistent Phishing Lures
A growing trend in which attackers weaponize Microsoft 365 collaboration features to deliver persistent phishing lures via Outlook calendar invites. By abusing Microsoft 365 Groups and Outlook calendar functionality, threat actors move malicious intent out of a single suspicious message and into routine productivity workflows, increasing the chance that targets will treat the interaction as…
-
CalPhishing Campaigns Use Outlook Calendar Invites to Deliver Persistent Phishing Lures
A growing trend in which attackers weaponize Microsoft 365 collaboration features to deliver persistent phishing lures via Outlook calendar invites. By abusing Microsoft 365 Groups and Outlook calendar functionality, threat actors move malicious intent out of a single suspicious message and into routine productivity workflows, increasing the chance that targets will treat the interaction as…
-
29-Year-Old Squid Proxy Vulnerability Exposes Authorization Headers and API Keys
A recently disclosed vulnerability in Squid Proxy, tracked as CVE-2026-47729 and referred to as “Squidbleed,” is exposing sensitive user data, including HTTP authorization headers and API keys. This issue arises from a decades-old memory-handling flaw in Squid’s codebase, dating back to at least 1997. It affects default configurations and illustrates how support for legacy protocols…
-
OpenAI Expands Daybreak With GPT-5.5-Cyber to Help Defenders Patch Security Flaws
OpenAI on Monday said it’s releasing an improved version of its GPT”‘5.5″‘Cyber model to trusted defenders as part of the Daybreak initiative, the artificial intelligence (AI) company announced last month.Calling GPT”‘5.5″‘Cyber its “strongest model yet for finding and helping patch software vulnerabilities,” OpenAI said the model can “sustain deeper analysis across large codebases” to identify…
-
OpenAI Lets Cyber Vendors Embed GPT-5.5 in Defenses
Tags: cyber, cybersecurity, defense, detection, incident response, openai, resilience, service, threat, vulnerabilityDaybreak Cyber Partner Program Extends GPT-5.5 Beyond Internal Security Use. OpenAI’s new Daybreak Cyber Partner Program allows 29 cybersecurity vendors, service providers and integrators to embed GPT-5.5 capabilities into customer-facing products and services, aiming to accelerate vulnerability remediation, threat detection, incident response and cyber resilience at scale. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/openai-lets-cyber-vendors-embed-gpt-55-in-defenses-a-32040
-
AI-powered cyber attacks may be just months away, warn Five Eyes
Frontier AI models will pose a greater cyber security risk to government and businesses than previously thought, putting businesses and governments at risk within months First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366644997/AI-powered-cyber-attacks-may-be-just-months-away-warn-Five-Eyes
-
OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic’s Mythos
Amid concerns about AI models’ cybersecurity capabilities, OpenAI revealed an improved version of GPT-5.5-Cyber and its “Patch the Plant” initiative to fix open-source software bugs. First seen on wired.com Jump to article: www.wired.com/story/openai-launches-full-scale-effort-to-patch-open-source-bugs-as-it-takes-on-anthropics-mythos/
-
Two Britons plead guilty to £39m 2024 cyber-attack on Transport for London
Thalha Jubair and Owen Flowers, linked to the Scattered Spider hacking group, change pleas on first day of expected six-week trial Two British cybercriminals linked to the Scattered Spider hacking group have pleaded guilty to a <a href=”https://www.theguardian.com/uk-news/article/2024/sep/02/transport-for-london-dealing-with-cyber-attack”>cyber-attack on Transport for London in 2024 that cost £39m and affected 10 million people.Thalha Jubair, 20, and…
-
Anthropic’s Mythos AI broke into almost all NSA classified systems in hours
Senate testimony claims Anthropic’s Mythos AI breached NSA and Cyber Command systems in hours, prompting a U.S.-ordered shutdown. On June 12, the Trump administration directed Anthropic to restrict access to Fable 5 and Mythos 5, its two most capable models, exclusively to US citizens. Because verifying every user’s nationality in real time isn’t practically possible,…
-
ClawHub Scope Squatting Lets Plugins Masquerade as Official OpenClaw Integrations
A supply-chain weakness in ClawHub’s plugin registry that allowed third-party packages to squat under organizational scopes and inherit first”‘party credibility. In a catalog review Manifold found 23 code”‘executing plugins published under the @openclaw/ and @clawhub/ scopes by accounts that have no verified relationship to either organization. Because ClawHub’s registry did not consistently enforce its documented…
-
QNAP Fixes 14 Vulnerabilities in QTS, QuTS Hero, QuTS Cloud, and QVP
QNAP has issued security advisory QSA-26-10, which addresses 14 vulnerabilities affecting its widely used NAS and surveillance platforms, including QTS, QuTS hero, QuTS cloud, and QVP (QVR Pro appliances). These vulnerabilities were disclosed on April 6, 2026, and are categorized as having “Important” severity. They impact the following versions: QTS 5.2.7, QuTS hero h5.2.8, QuTS…
-
Microsoft 365 Sensitivity Labels Now Block AI-Powered Content Analysis in Office Apps
Microsoft has announced a significant update to its Microsoft 365 ecosystem to enhance data protection. This update will prevent AI-powered and connected content analysis in Office applications when sensitivity labels are applied. According to Microsoft, the company is expanding the enforcement of the existing sensitivity label setting, “Prevent some connected experiences that analyze content.” This…
-
Malicious npm Package Masquerades as PostCSS Utility to Deliver PowerShell Downloader
A malicious npm package, postcss-minify-selector-parser, has been discovered masquerading as a benign PostCSS utility and delivering a multi-stage Windows remote access trojan (RAT). The imposter deliberately mimics the widely used postcss-selector-parser a legitimate library with more than 150 million weekly downloads by reusing the same keyword space (postcss, selector, parser, css) and depending on the…
-
Multi-Stage Steganographic Loader Deploys Remcos RAT and Multiple Infostealers Globally
A suspicious file named “GST Debit Note Apr_26.com,” which triggered a deeper investigation and revealed a polished, multi-stage steganographic loader delivering Remcos RAT and multiple infostealers across a global phishing campaign. The initial sample arrived as an archive attachment and unpacked to a 32-bit .NET executable that was unsigned and packed, masquerading as a legitimate…
-
282 iOS Apps Found Leaking LLM API Credentials in Network Traffic
Researchers have uncovered a systemic LLM credential exposure problem in the iOS ecosystem, with 282 AI”‘powered apps leaking exploitable API credentials and backend access mechanisms directly in network traffic. The findings highlight widespread misuse of OpenAI, Gemini, and other LLM provider APIs in mobile apps and show that many issues remain unpatched even after responsible…
-
LACUNA Chain Ghost Frames Technique Bypasses EDR Call-Stack Detection
The LACUNA Chain’s “Ghost Frames” technique introduces a new method for manipulating call stacks that effectively bypasses modern Endpoint Detection and Response (EDR) systems, which rely on kernel-level stack inspection. This marks a significant advancement in post-exploitation tactics. Security researcher Mohamed Alzhrani has described this technique as a continuation of previous research known as “HookChain,”…
-
LACUNA Chain Ghost Frames Technique Bypasses EDR Call-Stack Detection
The LACUNA Chain’s “Ghost Frames” technique introduces a new method for manipulating call stacks that effectively bypasses modern Endpoint Detection and Response (EDR) systems, which rely on kernel-level stack inspection. This marks a significant advancement in post-exploitation tactics. Security researcher Mohamed Alzhrani has described this technique as a continuation of previous research known as “HookChain,”…