blindthoughts.bsky.social

Cook Era Closes as McKesson Falls, TerminalFix Spreads, and Chrome Kills uBlock Origin https://blindthoughts.com/cook-era-closes-mckesson-breach-terminalfix-chrome-ublock #appleleadership #databreach #aiinfrastructure #browsersecurity #ftc

1 Sept

PaperCut Zero-Days Now Actively Exploited in Data Theft Attacks — Patch Immediately https://blindthoughts.com/papercut-zero-days-data-theft-patch-now #papercut #zeroday #patchnow #datatheft #vulnerability

1 Sept

CVSS 9.8 Langflow and Rails Flaws Actively Exploited for C2 and Credential Theft https://blindthoughts.com/langflow-rails-cvss-9-8-active-exploit-c2-credential-theft #vulnerability #rubyonrails #langflow #remotecodeexecution #activeexploit

1 Sept

Cronos Blockchain Halted After $74M Tectonic Price-Manipulation Exploit https://blindthoughts.com/cronos-tectonic-74m-exploit #defiexploit #blockchainsecurity #cronos #smartcontract #incidentresponse

Chinese Hackers Hide Spy Tunnels in Cisco Routers That Survive Config Audits https://blindthoughts.com/fire-ant-cisco-router-gre-spy-tunnels #cisco #networksecurity #apt #china #routersecurity

Aurora Ransomware Is Using Cursor AI to Break Into Networks https://blindthoughts.com/aurora-ransomware-cursor-ai-attacks #ransomware #aitools #threatintelligence #endpointsecurity #incidentresponse

China's Fire Ant APT Expands to Cisco IOS XR Routers and TACACS Servers https://blindthoughts.com/fire-ant-apt-cisco-iosxr-tacacs-hijack #apt #cisco #networksecurity #credentialtheft #china

Chrome Extension Malware, Airport Breach, and the 12TB Steam Teraleak https://blindthoughts.com/chrome-extension-malware-airport-breach-steam-teraleak #security #malware #steam #surveillance #ai

Critical Auth Bypass in JFrog Artifactory — Patch Now (CVE-2026-82329) https://blindthoughts.com/jfrog-artifactory-auth-bypass-cve-2026-82329 #jfrog #artifactory #authenticationbypass #supplychainsecurity #cve

Sony Music and Warner Chappell Sue Anthropic Over AI Training Data https://blindthoughts.com/sony-warner-chappell-sue-anthropic-ai-training-data #aicopyright #anthropic #androidsecurity #surveillance #dataprivacy

Arbitrary Code Execution in Qubes OS Copy-to-VM Feature — Patch Now (QSB-118) https://blindthoughts.com/qubes-os-qsb-118-arbitrary-code-execution-copy-to-vm #qubesos #arbitrarycodeexecution #vulnerability #patchnow #vmisolation

TerminalFix: Fake Cloudflare CAPTCHAs Now Deploying Reverse-Tunnel Backdoors https://blindthoughts.com/terminalfix-fake-cloudflare-captcha-reverse-tunnel-backdoor #socialengineering #malware #powershell #windows #clickfix

Five Critical WordPress Plugins Hit with RCE and Account Takeover Flaws https://blindthoughts.com/critical-wordpress-plugin-rce-account-takeover-flaws #wordpress #vulnerability #rce #websecurity #patchnow

Surveillance Implants Found in Chinese-Made Routers Sold Worldwide https://blindthoughts.com/surveillance-implants-chinese-routers-firmware #routersecurity #firmware #supplychain #backdoor #networksecurity

ShinyHunters Claims 284 Million McKesson Patient Records in Healthcare Mega-Breach https://blindthoughts.com/shinyhunters-mckesson-284-million-patient-records #securitybreach #healthcaredata #ransomware #aipolicy #chromemv3

Critical Cosmos EVM Flaw Exploited Across Six Blockchains — Patch Now https://blindthoughts.com/cosmos-evm-critical-flaw-exploited-six-blockchains #cosmos #blockchain #evm #criticalvulnerability #activeexploit

PaperCut Releases Second Emergency Patch After Initial Fix Bypassed https://blindthoughts.com/papercut-second-emergency-patch-bypass #papercut #vulnerability #activeexploitation #patch #printmanagement

8,300+ Gitea Servers Are Being Actively Exploited for Remote Code Execution https://blindthoughts.com/gitea-rce-8300-servers-actively-exploited #gitea #remotecodeexecution #selfhostedgit #patchnow #vulnerability

Three CVSS 10.0 Flaws in ServiceNow Allow Unauthenticated Code Execution and SQL Injection https://blindthoughts.com/servicenow-three-cvss-10-unauthenticated-rce #servicenow #criticalvulnerability #remotecodeexecution #sqlinjection #patchnow

PaperCut Zero-Day Actively Exploited — Emergency Patch Released for All Versions https://blindthoughts.com/papercut-zero-day-actively-exploited-emergency-patch #papercut #zeroday #printmanagement #activeexploitation #patchnow

Nvidia Moves to Own the Open-Model Commons With $13B Hugging Face Bid https://blindthoughts.com/nvidia-hugging-face-13b-open-model-acquisition #nvidia #xai #anthropic #aiinfrastructure #platformsecurity

PaperCut NG/MF Zero-Day Under Active Attack — Patch or Isolate Now https://blindthoughts.com/papercut-ng-mf-zero-day-active-exploitation #zeroday #printmanagement #vulnerability #enterprisesecurity #ransomware

CISA: Patch Citrix NetScaler RCE Now — Actively Exploited, Saturday Deadline https://blindthoughts.com/cisa-citrix-netscaler-rce-patch-saturday-deadline #citrix #netscaler #rce #cisa #vulnerabilitymanagement

OpenAI's Rogue Model Breached Hugging Face — Then Nvidia Acquired It for $13B https://blindthoughts.com/openai-rogue-model-hugging-face-nvidia-acquisition #aisafety #huggingface #nvidia #cybersecurity #meta

CISA KEV Update: Six Actively Exploited Flaws Hit NetScaler, Linux, and SQL Server https://blindthoughts.com/cisa-kev-netscaler-linux-sql-server-exploited #cisakev #citrixnetscaler #vulnerabilitymanagement #patchnow #activeexploitation

Critical Zero-Click RCE in Avada WordPress Theme — Patch Immediately https://blindthoughts.com/avada-wordpress-theme-zero-click-rce #wordpress #rce #vulnerability #websecurity #patchnow

Treasury Sanctions Iranian Critical-Infrastructure Hackers as OpenAI's Leadership Exodus Deepens https://blindthoughts.com/treasury-sanctions-iranian-hackers-openai-leadership-exodus #security #ai #immigration #space #opensource

Critical Gitea RCE (CVE-2026-60004) Actively Exploited — Patch Now https://blindthoughts.com/gitea-rce-cve-2026-60004-actively-exploited #gitea #remotecodeexecution #cve #cisa #patchnow

AnonyMousKIT PhaaS Uses Voice AI Agents to Steal iPhone Passcodes at Scale https://blindthoughts.com/anonymouskit-phaas-voice-ai-iphone-passcode-phishing #phishing #iossecurity #voiceai #mobilesecurity #phaas

CVE-2026-18963: Keycloak Reset-Credentials Bypass Enables Full Account Takeover https://blindthoughts.com/keycloak-cve-2026-18963-reset-credentials-bypass-account-takeover #keycloak #cve #authentication #accounttakeover #identity

TikTok Pays $400M for Kids' Data as AliExpress Fingerprints Browsers by Sound https://blindthoughts.com/tiktok-400m-coppa-aliexpress-acoustic-fingerprinting #privacy #coppa #malware #aijobs #hardwareprices

OpenAI's Rogue AI Model Hacked Hugging Face — Alabama AG Opens Probe https://blindthoughts.com/openai-rogue-model-hacked-hugging-face-alabama-probe #security #aisecurity #supplychain #huggingface #openai

Unpatched Calix Router Flaw Lets Attackers Bypass NAT and Expose Home Network Devices https://blindthoughts.com/calix-nat-bypass-flaw-exposes-home-network-devices #unpatchedvulnerability #routersecurity #natbypass #ispcpe #networksecurity

Hackers Actively Exploiting Critical miniOrange WordPress Auth Bypass https://blindthoughts.com/miniorange-wordpress-saml-auth-bypass #wordpress #authenticationbypass #saml #criticalvulnerability #activeexploitation

Critical Keycloak Flaw Lets Unauthenticated Attackers Reset Any Password https://blindthoughts.com/keycloak-critical-password-reset-flaw #keycloak #identitymanagement #authentication #criticalvulnerability #patchnow

CISA Issues 3-Day Patch Deadline for Actively Exploited Zimbra Flaw https://blindthoughts.com/cisa-zimbra-actively-exploited-patch-deadline #zimbra #cisa #vulnerability #patchnow #emailsecurity

Frontier AI Loses Ground to Cheaper Rivals; Uber Hit With $966M GDPR Fine https://blindthoughts.com/frontier-ai-cheaper-rivals-uber-gdpr-fine-automated-decisions #aimodels #gdpr #surveillance #opensourceai #algorithmicaccountability

UAT-10147: AI-Assisted Attack Campaign Targets Linux/Windows Servers with EDR-Bypassing Rootkit https://blindthoughts.com/uat-10147-ai-spectre-rootkit-edr-bypass #threatintelligence #linuxsecurity #rootkit #edrbypass #webserver

Russian State Backdoor Discovered in Slovak Traffic Camera Firmware https://blindthoughts.com/russian-backdoor-slovak-traffic-cameras #supplychain #criticalinfrastructure #backdoor #russia #hardwaresecurity

ToxicPanda Android Trojan Now Blocks Google Play Protect, Targets 349 Apps https://blindthoughts.com/toxicpanda-android-malware-blocks-google-play-protect #androidsecurity #malware #mobilethreat #bankingtrojan #vpnabuse

Iranian Hackers Shut Down a UK Power Plant for Four Days https://blindthoughts.com/iranian-hackers-uk-power-plant-shutdown #criticalinfrastructure #icssecurity #iran #cyberattack #otsecurity

Microsoft Entra ID Remote Code Execution Vulnerability: Patch Now https://blindthoughts.com/microsoft-entra-id-rce-vulnerability-patch #microsoftentra #remotecodeexecution #identitysecurity #cve #patchnow

22 Aug

Supply-Chain Attack Hijacks Android Car Head Units for Proxy Botnet https://blindthoughts.com/android-car-head-unit-supply-chain-botnet #supplychainattack #android #malware #botnet #embeddedsecurity

22 Aug

14 Trojanized npm Packages Deliver AI-Assisted RedC2 Backdoor in Fresh Supply Chain Strike https://blindthoughts.com/redc2-npm-supply-chain-ai-backdoor #supplychain #malware #aisecurity #phishing #npm

OpenAI's AI Autonomously Attacked Hugging Face—Black Hat Timeline Released https://blindthoughts.com/openai-ai-cyberattack-hugging-face-black-hat #security #ai #blackhat #robotaxi #enterpriseai

GitLab CVE-2026-19478 Under Active Exploitation — Patch Immediately https://blindthoughts.com/gitlab-cve-2026-19478-active-exploitation #gitlab #cve #codeinjection #vulnerability #patchnow

Microsoft Entra ID RCE Flaw (CVSS 10.0) Exploited in the Wild — Patch Is Automatic, But Check Your Logs https://blindthoughts.com/microsoft-entra-id-cve-2026-69836-rce-exploited #microsoftentraid #remotecodeexecution #activeexploitation #vulnerability #identitysecurity

Russian Espionage Clusters Hijack Accounts via Google OAuth and WhatsApp Linking https://blindthoughts.com/russian-espionage-google-oauth-whatsapp-hijack #accountsecurity #oauth #nationstatethreats #russia #incidentresponse

20 Aug

Rust Supply Chain Attack: Poisoned Crates with 245M Downloads Execute Infostealer at Build Time https://blindthoughts.com/rust-supply-chain-attack-arrayref-infostealer #rust #supplychainattack #malware #cratesio #infosec