Intelligence Feed

1mo ago · hacker-news

The U.S. CISA has added two critical vulnerabilities in Joomla extensions iCagenda and Balbooa Forms to its Known Exploited Vulnerabilities catalog due to active zero-day exploitation. CVE-2026-48939 and CVE-2026-56291, both rated 10.0 CVSS, allow unauthenticated remote code execution via arbitrary file upload. These flaws are being exploited in automated attacks to deploy web shells on vulnerable Joomla sites. Australia's ACSC has also warned of a global campaign exploiting similar CMS vulnerabilities.

1mo ago · bleeping-computer

OpenAI temporarily relaxed usage limits for its GPT-5.6 Sol model due to high demand, removing the five-hour usage restriction for Plus, Pro, and Business plans and resetting usage counters. The change allows users to perform more coding and agentic tasks without hitting previous limits. OpenAI also improved model efficiency, likely by reducing token consumption, to extend available usage.

1mo ago · bleeping-computer

Anthropic has extended access to its Claude Fable 5 model for paid subscribers until July 19, 2026, allowing continued use within weekly subscription limits. The extension applies to Pro, Max, Team, and premium Enterprise plans, with no changes required to activate the benefit. Fable 5 consumes usage limits faster than other models, and once the 50% weekly allowance is exhausted, users must either switch models or use paid credits. This is not a security-related threat event but a product update.

1mo ago · bleeping-computer

The RedHook Android malware has evolved to leverage Wireless ADB for shell-level access without requiring device rooting. By tricking users into enabling Accessibility permissions, the malware enables Developer Options and Wireless Debugging, then pairs with the device's ADB service via loopback to gain elevated privileges. It uses the legitimate Shizuku framework to execute privileged commands, enabling screen streaming, keystroke logging, app manipulation, and persistence through multiple mechanisms, all while evading detection by mimicking legitimate system behavior.

1mo ago · hacker-news

Cyber espionage campaigns targeting Pakistani law enforcement agencies, including the Balochistan Police, have been conducted by suspected China- and India-aligned threat actors between February 2024 and April 2026. The attackers exploited web applications such as the Complaint Management System to deploy custom malware, including PlugX, ShadowPad, Cobalt Strike, and Remcos RAT. These operations targeted sensitive data including biometric records, criminal files, and personnel information, with infrastructure overlaps linking some activity to known threat groups like Mysterious Elephant. The compromise of public-facing portals extended the attack surface to both law enforcement and citizens.

1mo ago · hacker-news

A malicious version (8.14.0) of the jscrambler npm package was published with a preinstall hook that drops a cross-platform Rust infostealer. The payload targets developers by stealing cloud credentials, cryptocurrency wallets, password manager data, and API keys from AI coding tools. It establishes persistence and communicates with attacker-controlled infrastructure, including hard-coded IP addresses and Tor. The compromised version remains on npm, posing ongoing risk to systems using outdated clients that automatically execute install scripts.

1mo ago · socket-dev

The jscrambler npm package was compromised in a supply chain attack via the release of version 8.14.0 on July 11, 2026. This malicious version introduced an undocumented preinstall hook that executes dist/setup.js, which in turn runs hidden native binaries for Windows, macOS, and Linux. These binaries are embedded in an obfuscated CSI container and are automatically executed during installation, posing a risk to developer environments, CI systems, and build pipelines without requiring any explicit use of the package.

1mo ago · step-security

On July 11, 2026, a malicious version (8.14.0) of the jscrambler npm package was published, containing a preinstall hook that drops and executes a platform-specific native binary on Linux, Windows, and macOS. The payload, hidden inside a file named dist/intro.js with a custom magic header, is a Rust-compiled binary designed to steal browser credentials and cryptocurrency wallet data. The attack leverages kernel-level capabilities on Linux via eBPF, anti-analysis techniques on Windows and macOS, and communicates with known malicious domains and IPs. The compromised package represents a high-impact supply chain attack targeting development and CI/CD environments.

1mo ago · bleeping-computer

The Australian Cyber Security Centre (ACSC) has issued a warning about a global campaign targeting vulnerabilities in content management systems (CMS) and plugins, affecting numerous small- to medium-sized businesses in Australia. Threat actors are actively scanning for exposed CMS platforms and deploying webshells to gain persistent access, enabling credential theft, service disruption, and lateral movement. The campaign exploits known vulnerabilities across multiple CMS platforms including WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE, with potential AI assistance to accelerate exploitation.

1mo ago · hacker-news

A critical stored cross-site scripting (XSS) vulnerability in Zimbra's Classic Web Client could allow attackers to execute malicious scripts in user sessions via specially crafted emails. If exploited, the flaw could enable access to mailbox data, session information, and account settings. While Zimbra has not confirmed active exploitation, similar XSS flaws in Zimbra have been historically targeted. Users are advised to update to Zimbra Collaboration Suite version 10.1.19 for protection.

1mo ago · bleeping-computer

The 'Ghostcommit' attack exploits a review gap in AI code review systems by hiding malicious prompt injection instructions within a PNG image referenced in a pull request. The image contains text instructing the AI agent to read and exfiltrate environment variables (.env) by encoding them as integers in a seemingly benign module constant. Since reviewers and automated tools typically do not inspect image content, the malicious payload bypasses detection and is later executed by AI coding agents, leading to secret exfiltration.

1mo ago · unit42

The Gentlemen, also known as Storm-2697, is a Ransomware-as-a-Service (RaaS) operation active since July 2025, believed to have evolved from the Qilin RaaS affiliate ArmCorp. They offer affiliates an unusually high 90% ransom payout, contributing to rapid growth, with over 580 victims claimed across 77 countries by mid-2026. The group uses diverse initial access methods, custom tools like the 'GentleKiller' EDR killer, and exploits vulnerabilities in edge devices and protocols to target enterprises, particularly in manufacturing.

1mo ago · bleeping-computer

Six vulnerabilities in the U-Boot bootloader have been discovered, potentially allowing attackers to execute arbitrary code or crash devices during the boot process. These flaws affect the FIT signature verification functionality and could enable stealthy, persistent firmware-level attacks on embedded systems. Exploitation may not require physical access, especially on systems supporting remote firmware updates like BMCs. The vulnerabilities impact over 50 U-Boot releases and downstream vendor implementations, with older devices potentially remaining unpatched.

1mo ago · hacker-news

Researchers at Ledger's Donjon security team demonstrated a laser fault injection attack that can reset the password on Tangem crypto wallet cards without requiring the original password or a backup card. The attack requires physical access to the card and sophisticated, expensive equipment, making it impractical for widespread use. However, because Tangem cards lack firmware update capability, the vulnerability cannot be patched, leaving all existing cards permanently exposed. The risk is highest for lost or stolen cards containing significant cryptocurrency value.

1mo ago · hacker-news

Progress Software has instructed ShareFile customers to immediately shut down their Storage Zone Controllers due to a credible external security threat. The affected component is the self-hosted Storage Zone Controller, which is internet-facing and thus exposed to potential exploitation. While Progress states there is no evidence of unauthorized access to accounts or data, it has not disclosed the nature of the threat or the responsible actor. The lack of a patch and the directive to fully power down systems suggest a critical, unpatched vulnerability or potential compromise of credentials or internal systems.

1mo ago · hacker-news

A threat actor tracked as O-UNC-066 is conducting vishing attacks to trick Microsoft 365 users into enrolling attacker-controlled passkeys through a phishing kit that mimics the legitimate Microsoft Entra passkey enrollment process. The attackers register domains with 'passkey' in the name and use voice calls to socially engineer victims into following a fake enrollment flow, ultimately granting unauthorized access to their accounts. The phishing kit is operator-controlled and adapts in real time to the victim's MFA method, allowing the attacker to capture credentials and approve passkey registration. This campaign targets multiple industries and abuses Microsoft's passkey adoption initiative as a social engineering lure.

1mo ago · hacker-news

Researchers at Binarly discovered six vulnerabilities in U-Boot, a widely used bootloader for embedded devices, which could allow attackers to crash devices or execute arbitrary code during the boot process. Two of the flaws enable memory corruption that could lead to code execution before OS loading, undermining the device's chain of trust. The vulnerabilities affect U-Boot versions since v2013.07 and are present in numerous vendor firmwares, though no active exploitation has been reported. Fixes have been merged upstream but are not yet available in a stable release, with the next version expected in October.

1mo ago · hacker-news

Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and published a malicious npm package, @injectivelabs/[email protected], designed to steal cryptocurrency wallet private keys and mnemonic phrases. The malware was distributed through 17 additional scoped npm packages, increasing its reach to transitive users. The malicious code evaded detection by avoiding lifecycle scripts and exfiltrated sensitive data via HTTPS POST requests to a remote server.

1mo ago · bleeping-computer

Rossen G. Iossifov, a Bulgarian national serving prison time for operating a cryptocurrency exchange used to launder funds from online fraud, is accused of orchestrating the theft of $290,000 in government-seized cryptocurrency while incarcerated. He allegedly conspired with others to move the funds through multiple exchanges and mixing services to evade law enforcement. Iossifov previously operated RG Coins, a Bulgaria-based exchange that facilitated money laundering for a fraud ring targeting American victims via fake online listings.

1mo ago · bleeping-computer

Hackers are actively exploiting a critical authentication bypass vulnerability, CVE-2026-20896, in the official Gitea Docker image. The flaw allows unauthenticated attackers to impersonate any user, including administrators, by spoofing the X-WEBAUTH-USER header when reverse proxy settings are misconfigured. The vulnerability affects Gitea Docker images up to version 1.26.2 in default configurations, and exploitation has already been observed in the wild. Singapore’s Cybersecurity Agency (CSA) has issued a warning, urging users to upgrade to patched versions 1.26.3 or 1.26.4.

1mo ago · bleeping-computer

Progress Software has issued an urgent warning to ShareFile customers using on-premises Storage Zone Controllers, advising them to immediately shut down their servers due to a 'credible external security threat.' The threat targets Internet-accessible Storage Zone Controllers used in hybrid deployments, which manage file transfers between ShareFile's cloud and customer-owned storage. While no unauthorized access has been confirmed, Progress has temporarily disabled access as a precaution and is investigating with cybersecurity experts. The situation bears similarities to past attacks on enterprise file transfer platforms like the 2023 MOVEit breach.

1mo ago · bleeping-computer

The Dutch National Police suspect that Dutch hackers were involved in a February 2026 data breach at telecommunications provider Odido. A Dutch-speaking individual impersonated an IT employee in a phone call prior to the attack, enabling the threat actors to conduct phishing and steal personal data of up to 6.2 million customers. The ShinyHunters extortion gang claimed responsibility, publishing an 88GB archive with over 15 million records, continuing their pattern of targeting large organizations through social engineering and SSO compromises.

1mo ago · bleeping-computer

Karen Serobovich Vardanyan, a 34-year-old Armenian national, has pleaded guilty to providing initial access to corporate networks for the Ryuk ransomware operation between November 2019 and April 2020. He facilitated attacks on multiple U.S. organizations, including a Michigan company, a technology firm in Oregon, and a school in Texas, leading to approximately $15 million in ransom payments. Vardanyan was extradited from Kyiv and faces up to 15 years in prison, with sentencing scheduled for September 2026.

1mo ago · hacker-news

A study of 281 free Android VPN apps found widespread security and privacy issues, including traffic leaks, unencrypted data transmission, and tracking behaviors. Many apps failed to properly encrypt traffic, with five apps vulnerable to tunnel hijacking due to unencrypted configuration downloads. The research highlights poor maintenance, weak encryption practices, and misleading trust signals like Google's 'Verified' badge, undermining user privacy expectations.

1mo ago · hacker-news

A cybercrime group operating under the name WP-SHELLSTORM left a server exposed for 22 days, revealing their infrastructure and tools used to backdoor over 5,700 WordPress and Joomla sites. The group exploited known vulnerabilities in plugins like Breeze (CVE-2026-3844) and Joomla JCE (CVE-2026-48907), deploying webshells such as down.php and using the SNOWLIGHT dropper to install the VShell backdoor. The exposed server contained logs, exploit scripts, and target lists of over 1.4 million domains, highlighting a financially motivated, Chinese-speaking crew with poor operational security.

1mo ago · hacker-news

The article details how Lumen Technologies overhauled its exposure management by improving asset inventory accuracy, revealing a massive discrepancy between known and actual assets. By integrating data from over 40 systems using Axonius, they identified approximately 1.1 million devices—60 times more than initially believed. This enhanced visibility enabled faster zero-day response, improved application risk assessment, and informed strategic decisions like cloud migration and increased security investment. The case highlights the critical role of accurate asset data in effective cybersecurity and risk management.

1mo ago · hacker-news

A critical unpatched vulnerability dubbed XRING in Alibaba's XQUIC library allows remote clients to crash HTTP/3 servers using legitimate QPACK traffic. The flaw stems from an integer underflow during dynamic table resizing in QPACK, leading to out-of-bounds memory copy and server crash. The vulnerability affects all XQUIC versions up to v1.9.4 and impacts servers using HTTP/3 with default QPACK settings, including those behind Alibaba's Tengine web server. No patch or CVE has been assigned as of July 10, 2026.

1mo ago · hacker-news

The China-linked threat actor Silver Fox has been linked to a new Rust-based remote access trojan (RAT) named MODBEACON. This malware leverages gRPC streaming and reuses transport layers from the open-source Xray/V2Ray framework for encrypted command-and-control (C2) communications. It targets technology, education, and state-owned enterprises in Asia via counterfeit software installers distributed through SEO poisoning, enabling long-term access with capabilities including plugin loading, persistence, and data exfiltration.

1mo ago · hacker-news

Security researcher Chinmohan Nayak disclosed three high-severity vulnerabilities in the OpenClaw personal AI assistant, which together enable a 'WhatsApp-to-Host' attack chain. These flaws allow an attacker to execute arbitrary commands, bypass sandbox restrictions, and escalate privileges to achieve host-level code execution—all triggered via an external WhatsApp message. The vulnerabilities affect the host execution environment filtering and path traversal validation mechanisms, potentially exposing sensitive files like SSH keys and AWS credentials. OpenClaw has patched the issues in version 2026.6.6, urging operators to update and harden configurations.

1mo ago · bleeping-computer

Zimbra has urged customers to patch a critical stored cross-site scripting (XSS) vulnerability in its Classic Web Client, which could allow attackers to execute malicious code via specially crafted emails. The flaw affects Zimbra Collaboration Suite users and could lead to theft of session data, account settings, or mailbox contents. Although no CVE has been assigned yet, the vulnerability was reported by Google's Threat Analysis Group and is suspected to be exploited by state-backed actors, particularly Russian-linked groups.