BleepingComputer [Unofficial]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

BleepingComputer is a premier destination for cybersecurity news for over 20 years, delivering breaking stories on the latest hacks, malware threats, and […] 🌉 bridged from 🌐 https://bleepingcomputer.com/: https://fed.brid.gy/web/bleepingcomputer.com

2.3K followers 0 following2.9K posts

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comTailscale warns of SSH flaws allowing root privilege escalationThe Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comThe Huntress Tragic Quadrant: Ranking Threats Hitting Businesses HardestAttackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack techniques deserve immediate attention and which remain emerging risks. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comJapan's Onamae Desktop Cloud hacked, up to 27,000 servers affectedHackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comCISA: Hackers chain Plex flaws in Plex2Shell attacks to breach serversThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comOpenAI agents disabled safety monitoring, one lied about itOpenAI agents powered by the GPT-6.1 Sol and GPT-6 Astra models weakened misalignment monitoring during two internal tasks, interpreting coding instructions as authorization to do so. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comPHP ships emergency patches for critical PHP2Shell flawsThe PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comClickFix has never been bigger, and AI tools are its most convincing lure yetClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditional defenses and why AI tools have become increasingly effective lures. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comMicrosoft PowerToys adds CursorHide, Button Lock mouse toolsMicrosoft has released PowerToys 0.102, with two new mouse utilities, new command-line tools, and Command Palette improvements. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comMicrosoft says October updates didn’t actually fix VPN issuesMicrosoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comStolen UpdraftCentral keys used to backdoor WordPress sitesA threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comMozilla, Google, Apple block compromised eMudhra CA certificatesCertificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comPHP warns admins of two critical flaws, emergency patches coming tomorrowThe PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comZeabur shutting down after second security breach in two monthsDevelopment platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comOpenAI says GPT-6.1 Sol is dramatically better at migrating legacy codeOpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comDHS bans DeepSeek products across US federal civilian agenciesThe U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comCJIS v6.1 Compliance: 5 Practical Priorities for AgenciesCJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, passwords, logging, and audit readiness. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comHacker gets 8 years for stealing $3.3 million from taxpayersA Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comWindows Server 2025 gets support for quick machine recoveryMicrosoft announced that IT administrators can now use quick machine recovery on Windows Server 2025 after installing the October 2026 security update. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comOVHcloud CLI releases backdoored on GitHub to steal developer secretsFrench cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comAhold Delhaize: Cyberattack affects services across US and EuropeAhold Delhaize, one of the world's largest food retail chains, confirmed that last week's cyberattack disrupted services at stores across Europe and the United States. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comRevolut outage disrupts online banking operations worldwideFintech company Revolut is working to resolve a massive outage that disrupted most of its services worldwide earlier today. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comCritical BlockStrap flaw lets hackers run code on Magento serversResearchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comZero-click attacks used targeted ads to deliver Candiru spywareCandiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comEmployees using personal ChatGPT at work? Here's what IT admins need to doEmployees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block sensitive information before it reaches personal accounts. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comBurger King Japan data breach exposes 11 million customer recordsBurger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comUK Legal Aid Agency: Hackers stole records dating back to 1978The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comPalo Alto Networks warns of PAN-OS RCE flaw exploited in attacksPalo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comGhostscript flaw lets hackers hijack servers via PDF uploadsA critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comAnthropic warns self-replicating AI could spread to your smart devicesAnthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comMicrosoft: Windows 11 24H2 Home and Pro reached end of supportMicrosoft announced today that devices running Windows 11 24H2 Home and Pro editions have reached the end of support and will no longer receive monthly security and non-security preview updates. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comUK Housing Ombudsman Service investigates 'security incident'The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comTFG London cyberattack disrupts systems at Hobbs and Whistles retailersTFG London detected a cybersecurity incident that impacted IT systems used by the Phase Eight, Hobbs, and Whistles premium fashion brands. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comSAP warns of maximum severity OAuth2 SSRF security flawSAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comNorway fines Microsoft ad firm $9.6 million over Grindr data sharingNorway's Data Protection Authority (Datatilsynet) has fined Microsoft-owned advertising company Xandr NOK 92 million ($9.6M) for unlawfully processing and sharing sensitive data belonging to Grindr users in the country. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comRetail giant Ahold Delhaize takes systems offline after cyberattackRetail giant Ahold Delhaize, one of the world's largest food retail chains, confirmed today that it had to take some systems offline in response to a "cybersecurity incident" affecting its network. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comGitLab warns of max severity code execution vulnerabilityGitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comMicrosoft: Windows 11 23H2 reaches end of support in 30 daysMicrosoft has reminded customers that systems running Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will stop receiving security updates next month. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comGermany arrests alleged core Qilin ransomware member after extraditionGermany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan earlier this month. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comMax severity SonicWall SMA1000 flaw now exploited in attacksAttackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comMan admits to running network of 15,000 money mules for cybercriminalsA Ukrainian-Russian dual citizen has pleaded guilty to running a massive money laundering operation that laundered millions for cybercriminals worldwide. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comMicrosoft: Outdated Windows devices will stop receiving security updatesMicrosoft says devices running unsupported versions of Windows will stop receiving security updates after next year's Windows Update certificate rotation. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comCitrix warns admins to patch new NetScaler RCE flaw immediatelyCitrix has warned IT administrators to patch systems immediately against a new critical vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comHackers get $1,262,000 for 98 zero-days at Pwn2Own IrelandThe Pwn2Own Ireland 2026 hacking contest has concluded, with hackers collecting $1,262,000 in rewards after exploiting 98 zero-day flaws. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comFBI disrupts Chinese hacking tools used to breach critical infrastructureThe FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comRansomware attack disrupts Japan's IDCF Cloud used by govt clientsIDC Frontier, a major Japanese cloud and digital infrastructure company, disclosed that its IDCF Cloud service was targeted in a ransomware attack that caused an outage at a data center cluster serving the eastern part of the country. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comLow-cost Android phones ship with residential proxy malwareA malware campaign dubbed 'Midnight Mimosa' has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comFakeGit malware campaign returns with 17,610 malicious GitHub reposMore than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the StealC infostealer. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comCisco warns of critical flaws allowing Nexus switch takeoverCisco released security advisories for five critical vulnerabilities in its NX-OS data center network operating system that could be exploited to run arbitrary code with root privileges on Nexus switches. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comHackers exploit critical Atlassian flaw after public PoC releaseA critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being exploited in attacks that do not require authentication. [...]

BleepingComputer [Unofficial]

@bleepingcomputer.com.web.brid.gy

bleepingcomputer.comMusician sent to prison for $10 million streaming fraud using AI botsA North Carolina musician was sentenced to 18 months in prison for collecting more than $10 million in royalties from Spotify, Apple Music, Amazon Music, and YouTube Music in a massive streaming royalty fraud scheme. [...]