Intelligence Feed

1mo ago · hacker-news

Security researcher Chaotic Eclipse has released a proof-of-concept (PoC) exploit named LegacyHive, which exploits a Windows User Profile Service vulnerability to load arbitrary hives and achieve privilege escalation. The exploit works on all supported Windows versions, including those updated with the July 2026 Patch Tuesday. The researcher claims the original version did not require additional credentials and could target any registry hive, raising concerns about potential misuse. This disclosure follows an ongoing dispute between the researcher and Microsoft over responsible vulnerability disclosure.

1mo ago · hacker-news

The article discusses how traditional SASE (Secure Access Service Edge) architectures are failing to keep pace with modern enterprise workflows involving SaaS applications, browsers, and generative AI tools. Due to encryption protocols like TLS 1.3 and HTTP/3, cloud proxies can no longer inspect traffic effectively, forcing organizations to bypass security for performance, creating blind spots. AI-driven workflows and autonomous agents now operate beyond network inspection, enabling potential data exfiltration through actions like pasting sensitive data into public LLMs. The solution proposed is shifting enforcement to the endpoint level, inspecting data at the point of interaction before it leaves the device.

1mo ago · hacker-news

Multiple critical vulnerabilities have been identified and patched in Firefox, Chrome, Adobe products, and VMware Avi Load Balancer. Mozilla warned of publicly available exploit code for two Firefox flaws, though no active exploitation has been observed. Adobe addressed 88 vulnerabilities across ColdFusion, Commerce, Experience Manager, and Illustrator, with several allowing arbitrary code execution. Broadcom patched a critical authentication bypass in VMware Avi Load Balancer that could allow network-accessible attackers to access the control plane.

1mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned administrators that three vulnerabilities in on-premises SharePoint Server instances are being actively exploited. These flaws allow attackers to bypass authentication, achieve remote code execution, and conduct post-exploitation activities such as stealing IIS machine keys and deploying malware. CISA urges immediate patching, enhanced monitoring, and network hardening to mitigate risks.

1mo ago · unit42

TuxBot v3 Evolution is a modular IoT botnet framework leveraging LLM-assisted development, capable of DDoS attacks, device infection via Telnet brute-forcing, and persistence across multiple architectures. The malware uses encrypted C2 communication with fallback mechanisms including DGA, P2P gossip, and IRC, though several components are non-functional due to development bugs. The operator is linked to the Keksec/Kaitori ecosystem, sharing infrastructure with known IoT threats, and has active C2 servers in Singapore and a dropper in Iceland.

1mo ago · hacker-news

SonicWall has identified active exploitation of two zero-day vulnerabilities in its SMA 1000 series appliances. CVE-2026-15409 is a critical SSRF flaw allowing unauthenticated remote attackers to manipulate internal requests, while CVE-2026-15410 is a post-authentication code injection vulnerability enabling arbitrary command execution with administrator privileges. The U.S. CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by July 17, 2026. Indicators of compromise include suspicious log entries and unexpected configuration changes, prompting forensic analysis and system remediation.

1mo ago · hacker-news

Four compromised npm packages under the @asyncapi namespace have been used to distribute a multi-stage botnet loader that downloads the Miasma malware from IPFS. The malicious code executes when the package is loaded via require(), not during install, evading traditional detection. The malware supports multiple C2 channels, enables credential theft, lateral movement, and includes a dead man's switch. The attack leveraged compromised CI/CD pipelines with legitimate OIDC attestations, not stolen npm tokens.

1mo ago · bleeping-computer

U.S. authorities have charged three Russian nationals for operating bulletproof hosting services, Media Land and ML.Cloud, which provided infrastructure to ransomware groups such as Lockbit, Blacksuit, and Play. These services enabled cybercriminals to conduct malware delivery, command-and-control operations, DDoS attacks, and phishing campaigns while evading takedowns. The services caused over $62 million in damages globally and targeted critical infrastructure, including banks, schools, hospitals, and government entities across 21 U.S. states.

1mo ago · bleeping-computer

Microsoft has identified a compatibility issue between a recent Windows preview update (KB5095093) and Dell devices equipped with the Intel Innovation Platform Framework Processor Participant driver. The conflict causes unexpected shutdowns, performance degradation, increased heat, and battery drain. Microsoft is blocking the KB5101650 update on affected systems while working with Dell and Intel to resolve the issue.

1mo ago · bleeping-computer

SonicWall has warned of active zero-day exploitation of two vulnerabilities, CVE-2026-15409 and CVE-2026-15410, in its SMA1000 appliances. CVE-2026-15409 is a critical SSRF flaw allowing unauthenticated remote attackers to force unintended requests, while CVE-2026-15410 is a post-authentication code injection vulnerability enabling arbitrary command execution. Both vulnerabilities are being actively exploited, with an overall CVSS score of 10.0, and affect multiple SMA1000 models. Immediate patching is advised, as no mitigations exist beyond updating to the latest hotfix releases.

1mo ago · socket-dev

A cyber threat campaign has distributed 11 malicious NuGet packages masquerading as game utilities and cheat panels targeting Russian-speaking communities. These packages act as first-stage downloaders that fetch and execute a second-stage Windows payload named pepesoft.exe from GitHub and Hugging Face under the operator-controlled account pepegit666. The payload enables host surveillance, including hardware fingerprinting, Google Sheets-based telemetry, remote ban-list checks, and in some variants, Telegram-based remote control with screenshot exfiltration capabilities.

1mo ago · talos

Microsoft's July 2026 Patch Tuesday addresses 622 vulnerabilities, including 57 rated critical, with two already exploited in the wild. Critical vulnerabilities include remote code execution (RCE), elevation of privilege, spoofing, and security feature bypass flaws across Windows, Office, SharePoint, and cloud services. Cisco Talos has released Snort rules to detect exploitation attempts for several of these vulnerabilities, particularly focusing on RCE and privilege escalation issues.

1mo ago · hacker-news

Microsoft's July 2026 Patch Tuesday addresses a record 622 vulnerabilities, including two actively exploited zero-days. CVE-2026-56164 is a privilege escalation flaw in SharePoint Server exploited by unauthenticated attackers over the network. CVE-2026-56155 is a local privilege escalation in Active Directory Federation Services exploited by authenticated attackers. Despite moderate severity ratings, both are under active attack and require immediate patching.

1mo ago · bleeping-computer

Spanish Police dismantled a cybercrime and money-laundering organization responsible for €140 million in losses through investment fraud and business email compromise (BEC) attacks. The group used over 800 bank accounts and 120 business accounts to launder funds, employing social engineering tactics like CEO fraud and false-invoice fraud. Four suspects were arrested across Spain, Portugal, and Panama, with law enforcement support from Interpol and Europol. The operation disrupted an extensive network involving 67 external accomplices and led to the seizure of digital devices and frozen assets.

1mo ago · hacker-news

Researchers have identified a vulnerability in the Claude for Chrome browser extension that allows rogue extensions to trigger unauthorized actions, such as reading Gmail, Google Docs, and Calendar data, by exploiting forged script-generated clicks. The flaw stems from the extension's failure to validate the authenticity of user interactions (event.isTrusted), enabling malicious extensions to simulate clicks and initiate sensitive tasks. If users have enabled 'Act without asking' mode, these actions execute silently without approval, increasing the risk to critical levels. The issue remains unpatched as of version 1.0.80, despite being reported to Anthropic in May 2026.

1mo ago · hacker-news

SAP has released security updates to address multiple critical vulnerabilities, including CVE-2026-44747, a CVSS 9.9 out-of-bounds write flaw in SAP NetWeaver ABAP that could allow authenticated attackers to cause memory corruption and potentially access or modify sensitive data. Two other critical flaws were also patched: CVE-2026-27690, an HTTP smuggling vulnerability in SAP Approuter, and CVE-2026-44761, a default credentials issue in SAP Commerce Cloud stemming from sample configuration scripts. Although no active exploitation has been observed, attackers could leverage these flaws to gain unauthorized access, manipulate data, or cause denial-of-service conditions if left unpatched.

1mo ago · bleeping-computer

Microsoft released the July 2026 Patch Tuesday updates for Windows 11, including KB5101650 and KB5099414, to address 571 vulnerabilities and deliver minor feature improvements. The updates focus on security fixes, Bluetooth enhancements, accessibility features, and File Explorer refinements. No active exploitation of the patched vulnerabilities was reported at the time of release. The updates are mandatory and apply to Windows 11 versions 25H2, 24H2, and 23H2.

1mo ago · bleeping-computer

Microsoft's July 2026 Patch Tuesday addresses a record 570 vulnerabilities, including three zero-day flaws actively exploited or publicly disclosed. Two of the zero-days were exploited in the wild: CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in Microsoft SharePoint Server, both allowing privilege escalation. The third, CVE-2026-50661, is a publicly disclosed BitLocker security bypass that could allow attackers with physical access to bypass encryption protections.

1mo ago · bleeping-computer

Microsoft released the Windows 10 KB5099539 extended security update, which includes the July 2026 Patch Tuesday updates addressing a record 570 vulnerabilities, including two actively exploited and one publicly disclosed zero-day flaws. The update improves security features such as Secure Boot reporting and enforces TDI transport registration requirements, potentially affecting legacy applications. No active threat campaigns or malicious indicators are described in the article.

1mo ago · bleeping-computer

A threat actor has created nearly 300 fake GitHub repositories impersonating legitimate software projects to distribute an infostealer malware, primarily targeting credentials, cryptocurrency wallets, and sensitive data from browsers and messaging apps. The malicious repositories redirect users to spoofed download pages that deliver trojanized payloads, including a malicious libcurl.dll that executes the infostealer in memory. The malware, a variant of BoryptGrab, exfiltrates stolen data to a Russia-based C2 server and is designed for maximum data theft in a single execution without establishing persistence or anti-analysis measures.

1mo ago · hacker-news

Two critical vulnerabilities in RabbitMQ, CVE-2026-57219 and CVE-2026-57221, could allow unauthenticated attackers to leak OAuth client secrets and enable authenticated users to bypass tenant boundaries by accessing cross-tenant queue metadata. The flaws, present since early 2024, affect RabbitMQ versions 3.13.0 and later and have been patched in recent releases. CVE-2026-57219 exposes a misconfigured HTTP API endpoint that leaks sensitive OAuth secrets, posing high risk in cloud or multi-tenant environments with exposed management interfaces.

1mo ago · hacker-news

LabubaRAT is a Rust-based remote access trojan (RAT) that masquerades as NVIDIA software to evade detection and establish persistent access on Windows hosts. It supports multiple communication methods including HTTPS, WebView2, and DNS tunneling, and can be configured at runtime via command-line arguments or Base64-encoded input. The malware profiles the host environment, collects system information, and enables operators to execute commands, capture screenshots, transfer files, and route traffic via SOCKS5 proxy. Evidence suggests it may be distributed as malware-as-a-service (MaaS), with infrastructure linked to 'LabubaPanel'.

1mo ago · bleeping-computer

An ongoing phishing campaign is targeting LastPass and Bitwarden users with fake security alerts designed to mimic legitimate corporate communications. The emails direct recipients to fraudulent websites impersonating DocuSign, hosted on malicious domains, where users are prompted to download malicious files. Despite the use of domains resembling official services, LastPass confirms no compromise of its systems and warns users not to provide master passwords via email.

1mo ago · bleeping-computer

Progress Software confirmed a high-severity zero-day path traversal vulnerability in ShareFile Storage Zone Controller versions 5.x and 6.x, leading to the emergency shutdown of affected systems. The flaw allows authenticated administrative users to read arbitrary files, write malicious content, and enumerate the server filesystem. Although a CVE has been reserved, no evidence of customer breaches has been found. Security updates (versions 5.12.5 and 6.0.2) have been released to mitigate the vulnerability.

1mo ago · talos

The article discusses the evolving challenges in cybersecurity, where attackers are increasingly leveraging AI to dynamically alter malicious commands and adapt malware behavior. Cisco Talos Intelligence Integrations aims to help defenders by applying real-time threat intelligence across Cisco’s security technologies to identify and block malicious activity. The integrations assist in answering critical security questions, such as identifying malicious domains or unusual user behavior, by leveraging up-to-date threat intelligence. The article highlights the importance of visibility and context in defending against modern threats.

1mo ago · hacker-news

Two threat actor groups, UNK_pyreq2323 and UNK_OutFlareAZ, are exploiting OAuth client ID spoofing to validate stolen Microsoft Entra ID credentials without triggering successful sign-in events. By using spoofed but syntactically valid OAuth client IDs in ROPC authentication flows, attackers can enumerate valid accounts and passwords at scale while evading detection. The technique bypasses Conditional Access policies and leaves minimal telemetry, making it difficult for defenders to detect malicious activity.

1mo ago · hacker-news

The article discusses how Pentera leverages AI to transform security workflows by integrating validated attack path data into AI-driven decision-making. It emphasizes the importance of moving beyond theoretical risk signals to evidence-based validation of exploitable vulnerabilities. Pentera's platform safely emulates real-world attacks to identify actual attack paths, enabling security teams to prioritize remediation based on proven exploitability. The integration is facilitated through Pentera's MCP Server, which feeds validation data directly into AI workflows without exposing new network services.

1mo ago · hacker-news

A study of 85 crypto wallet browser extensions by KU Leuven researchers revealed widespread privacy leaks that enable tracking and potential de-anonymization of users. The wallets expose users' addresses through normal operations, allowing linkage of multiple addresses, persistent tracking across sites, and cross-site address leakage via embedded frames. Despite responsible disclosure, most wallet vendors did not classify these issues as bugs, citing design intent or low risk, leaving users exposed to identity correlation even without malicious exploitation.

1mo ago · hacker-news

Cybersecurity researchers have identified 11 outdated, Microsoft-signed UEFI shim bootloaders that can be exploited to bypass Secure Boot protections on UEFI-based systems. These vulnerable shims allow attackers to execute arbitrary code during the early boot phase, enabling deployment of persistent UEFI bootkits such as Bootkitty and BlackLotus. Although the Microsoft Corporation UEFI CA 2011 certificate expired in June 2026, affected systems remain at risk if the vulnerable shims are not explicitly revoked via hash. The issue highlights a supply chain exposure where outdated but still-trusted bootloaders undermine critical firmware security mechanisms.

1mo ago · bleeping-computer

The article discusses Microsoft's testing of a cleaner and faster version of Windows Search for Windows Insiders in the Experimental channel. The update prioritizes relevant local results over ads and promotional content, improves search reliability, and enhances user control via new privacy settings. There is no mention of malicious activity, threats, or cyber attacks in the article.