Tag: dns
-
US Government Email Systems Open to Abuse Thanks to Typos
Erroneous or outdated DNS records can give attackers surprising powers over organizations’ email systems. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/us-government-email-systems-abuse-typos
-
ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration
esearch by: Alexey Bukhteyev Key Takeaways Introduction Earlier this year, Check Point Research disclosed a security flaw in ChatGPT’s code-execution runtime that allowed sensitive conversation data to be silently exfiltrated to an attacker-controlled server through DNS tunneling, a hidden outbound channel that bypassed the runtime’s network isolation. A fix for this issue was promptly deployed.…
-
China-Aligned Group Abuses Sogou Input Method to Deliver Malware
SlippyNunchucks used DNS hijacking to turn Sogou brand promotions into a malware channel First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/slippynunchucks-sogou-dns-hijacking/
-
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP).The campaign, observed starting July 1, 2026, is assessed to have targeted…
-
Cloudflare DDoS Report Shows 18.2 Million Network Attacks in Q3 2026
The Cloudflare DDoS report Q3 2026 reveals 18.2M network attacks, a 208% surge in short-burst floods, and a major shift toward DNS and UDP attacks. First seen on securityonline.info Jump to article: securityonline.info/cloudflare-ddos-report-q3-2026/
-
AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records
AbuseBox is a free, open-source tool that checks IP addresses and domains against 60 DNS blacklists, pulls reputation scores from AbuseIPDB, inspects DNS, SSL and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/28/abusebox-open-source-ip-blacklist-monitoring/
-
Node.js Patches 10 Security Vulnerabilities, Including High-Severity RCE Flaw
The Node.js Project released security updates on October 21, 2026, addressing 10 vulnerabilities across its 26.x, 24.x, and 22.x release lines. The updates fix a critical Brotli decoder flaw that allows remote code execution, as well as weaknesses in DNS resolution, TLS certificate validation, cryptographic randomness, and filesystem permissions. The release addresses four high-severity, three…
-
Researchers Uncover GhostShares Flaw That Makes Meta Muse AI Conversations Easy to Find
A privacy weakness in Meta’s Muse AI assistant that made shared conversations discoverable through passive DNS records, exposing personal files and internal business documents. Dubbed GhostShares, the issue affected public sharing links whose supposedly unguessable identifiers appeared inside searchable hostnames. Meta told Ars Technica on October 20 that it was suspending the feature. The finding…
-
Meta Muse: Forscher finden Tausende geteilte KI-Chats über DNS-Datenbanken
Geteilte Chats des KI-Bots Muse von Meta wurden über passive DNS-Datenbanken gefunden – damit auch private Inhalte. First seen on golem.de Jump to article: www.golem.de/news/meta-muse-forscher-finden-tausende-geteilte-ki-chats-ueber-dns-datenbanken-2610-214351.html
-
Researchers Uncover 20,000 Malicious Cloudflare Pages Domains Used in Tech Support Scams
More than 20,000 malicious Cloudflare Pages subdomains used by Help TDS, a longstanding traffic distribution system that funnels victims into fraudulent technical support call centers. Researchers assess with high confidence that Hotejka, a Russian-language affiliate program, operates Help TDS and represents a rebrand of ROI777. Historical DNS records, shared infrastructure, persistent affiliate identifiers, and consistent…
-
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week’s security stories.The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person.…
-
How DNS, Firewalls and Endpoint Tools Block Websites
Website filtering can be enforced at four points in a request’s lifecycle. What each layer sees, what routes around it, and why network filters miss traffic. First seen on hackread.com Jump to article: hackread.com/how-dns-firewalls-endpoint-tools-block-websites/
-
Partisan Zmiy Malware Campaign Uses Telegram and DNS Tunneling to Target Healthcare Networks
A prolonged Partisan Zmiy intrusion into a medical organization, exposing an updated malware toolkit that combined Telegram command channels, DNS tunneling, and scheduled payload execution. Investigators joined the response in December 2025 and traced the earliest evidence of compromise to early 2024, indicating approximately two years of access without observed destructive activity. The organization maintained…
-
ClickFix Attacks Evolve to Better Hide Malicious Payloads
Threat actors are now hiding payloads by using DNS TXT records and browser cache pre-fetching, making it tougher to spot early attack stages. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/clickfix-attacks-evolve-better-hide-malicious-payloads
-
ClickFix Attacks Evolve to Better Hide Malicious Payloads
Threat actors are now hiding payloads by using DNS TXT records and browser cache pre-fetching, making it tougher to spot early attack stages. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/clickfix-attacks-evolve-better-hide-malicious-payloads
-
Axios Flaws Let Attackers Bypass Proxy Controls and Trigger SSRF Attacks
Axios maintainers have disclosed several high-severity security vulnerabilities that could allow attackers to bypass proxy and DNS controls in server-side applications, potentially enabling server-side request forgery (SSRF) against internal services and cloud metadata endpoints. The most critical issue, tracked as GHSA-3pq3-5fj3-cg6v, affects Axios’s HTTP/2 request path. This vulnerability arises because the HTTP/2 adapter establishes sessions…
-
FritzOS 8.50 ist fertig: Fritzboxen erhalten bessere DNS-Filter-Funktionen und Ausfallschutz
Tags: dnsZu den Neuerungen von FritzOS 8.50 gehören verbesserte DNS-Filter-Funktionen, ein Ausfallschutz sowie optimierte Diagnose- und Smart-Home-Funktionen. First seen on golem.de Jump to article: www.golem.de/news/fritzos-8-50-ist-fertig-fritzboxen-erhalten-bessere-dns-filter-funktionen-und-ausfallschutz-2609-213562.html
-
Zero-Click Vulnerabilities in Salesforce Agentforce Expose Wider AI Agent Risk
The ‘SalesBleed’ set of weaknesses in Salesforce’s Agentforce agents exposed CRM data to attackers via prompt injection and DNS exfiltration First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/vulnerabilities-salesforce-ai/
-
Zero-Click Vulnerabilities in Salesforce Agentforce Expose Wider AI Agent Risk
The ‘SalesBleed’ set of weaknesses in Salesforce’s Agentforce agents exposed CRM data to attackers via prompt injection and DNS exfiltration First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/vulnerabilities-salesforce-ai/
-
Salesforce Agentforce Flaw Enables 0-Click Data Exfiltration via Prompt Injection
Security researchers have revealed a vulnerability chain known as “SalesBleed,” associated with Salesforce’s Agentforce. This vulnerability could allow attackers to extract sensitive CRM data through an indirect prompt injection embedded in a public Web-to-Lead form. The attack does not require a Salesforce login or a click from the victim and could leak data via DNS…
-
Data dive: Mapping UK police forces’ hyperscale dependence
Computer Weekly used public DNS records to map which outside companies Britain’s 48 police forces connect to and found a service that has quietly standardised on one US hyperscaler First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366650799/Data-dive-Mapping-UK-police-forces-hyperscale-dependence
-
PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner
A sophisticated cryptomining campaign is employing multiple layers of obfuscation to conceal malicious PowerShell payloads and ultimately deploy an XMRig-based cryptocurrency miner. This obfuscation includes Windows Registry entries, DNS TXT records, PNG images, and WAV audio files. The infection was detected after repeated security alerts indicated suspicious PowerShell activity. The initial execution command launched PowerShell…
-
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday.An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution.Unbound 1.26.1, released the same day, fixes the bug, tracked as…
-
BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS
The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH).A sender with no credentials can crash the server process, named, with a single request that…
-
The Best DNS Security Solutions, Compared and Priced (2026)
DNS security delivers more blocked attacks per dollar than any other network control when you buy the right shape at the right tier. The value verdict: DNSFilter and SafeDNS own transparent per-user pricing for SMBs, Cloudflare Gateway starts free and scales to national infrastructure (it now runs the UK’s public-sector PDNS with Accenture), Cisco Umbrella…
-
Data dive: Mapping NHS hyperscaler dependence
Mapping NHS DNS data reveals a heavy reliance on US hyperscalers, with Microsoft 365 routing email and infrastructure for the vast majority of trusts in a tangled web of connections First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366649921/Data-dive-Mapping-NHS-hyperscaler-dependence
-
SLEEPWALKER Malware Uses Raw Packets, DNS and VMware VMCI for Covert Communications
A newly analyzed Windows backdoor named SLEEPWALKER uses a passive command-and-control model designed to evade conventional beaconing-based detections. Raw-packet activation, DNS-based tasking support, VMware VMCI communications, named-pipe capabilities, and in-memory payload execution. No threat actor, victim, delivery chain, or live campaign has yet been attributed to the malware. SLEEPWALKER is an unsigned 64-bit Windows DLL…