CyberHub

CyberHub

@cyberhub.blog

→ News, podcast, subreddit and yt video summaries → CVE alerts → CTF challenges https://www.cyberhub.blog #cybersecurity #hacking #cve #tech #news #ai

523 followers376 following31.7K posts

CyberHub
@cyberhub.blog

📌 Cybercriminals Use Fake News Ads and AI to Spread Crypto Clipper Malware https://www.cyberhub.blog/article/27230-cybercriminals-use-fake-news-ads-and-ai-to-spread-crypto-clipper-malware

cyberhub.blogCybercriminals Use Fake News Ads and AI to Spread Crypto Clipper MalwareAn unidentified threat actor has been observed using paid or promoted posts on legitimate news websites to generate interest in their malicious software, as reported by Check Point Research. The campaign involves a central WordPress phishing page, alongside GitHub and SourceForge projects promoted via fake accounts, as well as a YouTube channel. The attack leverages fake reviews, AI-generated narrators, and comments on VirusTotal to distribute a crypto clipper malware. No specific dates, victim counts, or technical indicators (e.g., hashes, CVE IDs) were disclosed in the available content. The primary impact involves the theft of cryptocurrency by manipulating clipboard data.
CyberHub
@cyberhub.blog

📌 International Operation Endgame Dismantles Evil Corp's SocGholish Malware Infrastructure https://www.cyberhub.blog/article/27237-international-operation-endgame-dismantles-evil-corps-socgholish-malware-infrastructure

cyberhub.blogInternational Operation Endgame Dismantles Evil Corp's SocGholish Malware InfrastructureOperation Endgame, a law enforcement effort involving four countries, dismantled a criminal infrastructure linked to the Russian group Evil Corp this week. The operation sanitized 14,971 WordPress sites infected with the SocGholish malware and took offline 106 servers and domains. Additionally, 54% of analyzed enterprises were found to be exposed to related threats. The operation, launched in 2024, targeted the infrastructure supporting SocGholish, a malware strain attributed to Evil Corp. No specific CVE IDs or additional technical details were provided in the report.
CyberHub
@cyberhub.blog

📌 Analysis of QoS Policies to Restrict EDR Traffic and Detection Strategies https://www.cyberhub.blog/article/27238-analysis-of-qos-policies-to-restrict-edr-traffic-and-detection-strategies

cyberhub.blogAnalysis of QoS Policies to Restrict EDR Traffic and Detection StrategiesThe Reddit post references an external article discussing Quality of Service (QoS) policies as a method to restrict Endpoint Detection and Response (EDR) traffic. It focuses on techniques that may limit or manipulate EDR telemetry and detection capabilities. The post provides a link to a blog entry titled 'QoS Policies' on ipurple.team.
CyberHub
@cyberhub.blog

📌 German Informatics Society Study Examines Router Security and Digital Sovereignty https://www.cyberhub.blog/article/27245-german-informatics-society-study-examines-router-security-and-digital-sovereignty

cyberhub.blogGerman Informatics Society Study Examines Router Security and Digital SovereigntyThe Gesellschaft für Informatik e.V. (German Informatics Society) published a study examining router security and digital sovereignty in Germany. The research focuses on the current state of router vulnerabilities and their implications for users and infrastructure within the country. No specific technical details, such as CVEs, numbers, or dates, were provided in the available content. The study aims to highlight security risks associated with routers, though the exact impacts or findings are not explicitly stated. The report is part of an effort to assess and improve cybersecurity measures for network devices.
CyberHub
@cyberhub.blog

📌 The Cyber Show Explores IoT Security Risks and Penetration Testing in New Episode https://www.cyberhub.blog/article/27247-the-cyber-show-explores-iot-security-risks-and-penetration-testing-in-new-episode

cyberhub.blogThe Cyber Show Explores IoT Security Risks and Penetration Testing in New EpisodeThis episode of *The Cyber Show* features Ken Munro from Pen Test Partners, who discusses the security risks of connected devices, often referred to as the Internet of Things (IoT). The conversation explores how these devices, from smart TVs to children’s toys, can become vulnerabilities in homes and businesses due to poor security practices. Munro explains that while many manufacturers prioritize speed and functionality over security, the consequences can range from privacy invasions to life-threatening risks, particularly in medical or industrial settings. One of the central topics is the nature of penetration testing (pen testing), where security experts simulate cyberattacks to identify weaknesses in systems. Munro describes how pen testers look for misconfigurations, open ports, or flawed encryption in devices—often finding that developers 'roll their own' security solutions instead of using proven standards. This leads to vulnerabilities, such as unencrypted data transmissions or undocumented backdoors that hackers can exploit. For example, a smart TV was found sending voice recordings to a third-party server in plain text, exposing private conversations. The discussion highlights how even well-intentioned features, like remote support for industrial devices, can become security risks if not properly documented or secured. The episode also delves into the motivations behind insecure IoT devices. Munro argues that most vulnerabilities stem from oversight rather than malicious intent—manufacturers rush products to market without adequate security testing or funding for long-term updates. However, he acknowledges that some companies collect excessive data under vague terms of service, often selling it to brokers. This raises ethical concerns, particularly when sensitive data, such as usage patterns from smart sex toys, could endanger users in regions where certain behaviors are criminalized. The conversation underscores the need for better regulations, like the UK’s Product Security and Telecommunications Infrastructure (PSTI) Bill, which mandates security standards and support lifespans for devices. Yet, enforcement remains a challenge, leaving consumers to navigate a market where security is rarely transparent. Another key focus is the unintended consequences of IoT in sensitive environments, such as healthcare. Munro shares a chilling example of a flawed insulin pump system where hackers could have altered blood sugar readings, leading to fatal doses of insulin. While IoT can enable life-saving innovations like continuous glucose monitoring, the lack of rigorous security testing in medical devices poses severe risks. The episode also touches on 'right to repair' debates, where users are often denied control over their devices due to proprietary software or legal restrictions. Munro advocates for 'everything off by default' policies, where users explicitly enable features like microphones or cameras, and for manufacturers to disclose how long they will support a product’s security updates. Without these measures, devices become liabilities once support ends, leaving users vulnerable to exploits. Finally, the discussion addresses the broader societal impact of IoT, including disinformation and the erosion of privacy. Munro points out how seemingly benign devices, like smart meters, can reveal intimate details about a household’s habits, while CCTV cameras with undocumented audio recording capabilities can turn into surveillance tools. The episode concludes with practical advice for consumers, retailers, and governments. Consumers are urged to research products for past vulnerabilities before purchasing, while retailers should vet suppliers for long-term support commitments. Governments are encouraged to enforce existing regulations and resist industry lobbying that prioritizes speed over security. The overarching message is that IoT security requires a cultural shift—one where manufacturers, regulators, and users all take responsibility for safeguarding data and privacy in an increasingly connected world.
CyberHub
@cyberhub.blog

📌 Analysis of the PrizeBuzz Phishing Network Campaign https://www.cyberhub.blog/article/27252-analysis-of-the-prizebuzz-phishing-network-campaign

cyberhub.blogAnalysis of the PrizeBuzz Phishing Network CampaignThe post presents an analysis of the PrizeBuzz phishing campaign, detailing its use of fake brand pages, rotating domains, and reused infrastructure. The author shares the findings as part of a write-up focused on phishing analysis and tracking malicious infrastructure.
CyberHub
@cyberhub.blog

📌 Outdated REDCap Servers Targeted by China-Linked Threat Actor UNC6508 https://www.cyberhub.blog/article/27255-outdated-redcap-servers-targeted-by-china-linked-threat-actor-unc6508

cyberhub.blogOutdated REDCap Servers Targeted by China-Linked Threat Actor UNC6508The majority of internet-accessible REDCap servers are running outdated versions. These servers are regularly targeted by the China-linked threat actor UNC6508 for initial access and backdoor deployment. No specific numbers, dates, or CVE identifiers are provided in the article content.
CyberHub
@cyberhub.blog

📌 Splunk Warns of Active Exploitation of Critical Code Smuggling Vulnerability in Enterprise Software https://www.cyberhub.blog/article/27263-splunk-warns-of-active-exploitation-of-critical-code-smuggling-vulnerability-in-enterprise-software

cyberhub.blogSplunk Warns of Active Exploitation of Critical Code Smuggling Vulnerability in Enterprise SoftwareSplunk has issued a warning that malicious actors are actively exploiting a critical code smuggling vulnerability in Splunk Enterprise. The company has released updates to address the flaw, though specific technical details such as CVE identifiers, affected versions, or exact exploitation methods were not disclosed. The attacks target the vulnerability to compromise Splunk Enterprise instances, though the precise impact—such as potential data exfiltration or remote code execution—remains unspecified. No timeline for the attacks or patch availability was provided in the notice. The advisory emphasizes the urgency of applying the available updates to mitigate risks.
CyberHub
@cyberhub.blog

📌 Is TryHackMe PT1 Certification Suitable for Absolute Beginners? https://www.cyberhub.blog/article/27265-is-tryhackme-pt1-certification-suitable-for-absolute-beginners

cyberhub.blogIs TryHackMe PT1 Certification Suitable for Absolute Beginners?The post asks for opinions on the TryHackMe PT1 certification, including experiences studying for it and whether the £300 ($350) fee is justified. The author expresses interest in a Blue Team role but wants to first learn foundational offensive security concepts. They are seeking feedback from others who have completed the certification.
CyberHub
@cyberhub.blog

📌 U.S. Government Suspends Access to Claude Fable 5 Over Jailbreak Vulnerability Affecting Global User... https://www.cyberhub.blog/article/27272-us-government-suspends-access-to-claude-fable-5-over-jailbreak-vulnerability-affecting-global-users

cyberhub.blogU.S. Government Suspends Access to Claude Fable 5 Over Jailbreak Vulnerability Affecting Global UsersThe U.S. government suspended access to *Claude Fable 5* following a perceived disproportionate response to a technical issue. The suspension applies immediately and affects users and businesses globally, including those in Europe. The decision stems from a *jailbreak* vulnerability, though the article specifies it was not universally exploitable. No specific technical details, dates, or CVE identifiers were provided regarding the flaw. The impact extends to European enterprises due to the cross-border nature of the restriction.
CyberHub
@cyberhub.blog

📌 Request for Sherlock HackTheBox Discussion Community on Discord https://www.cyberhub.blog/article/27277-request-for-sherlock-hackthebox-discussion-community-on-discord

cyberhub.blogRequest for Sherlock HackTheBox Discussion Community on DiscordThe post requests assistance in finding a Discord server where users discuss Sherlock HackTheBox (HTB) machines. The author mentions that Insane difficulty machines are challenging and seeks a community for learning purposes. No specific Discord server or additional details are provided in the post.
CyberHub
@cyberhub.blog

📌 CVE-2026-101390 - Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affe... https://www.cyberhub.blog/cves/CVE-2026-101390

cyberhub.blogCVE-2026-101390Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterpris
CyberHub
@cyberhub.blog

📌 CVE-2026-101411 - Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affe... https://www.cyberhub.blog/cves/CVE-2026-101411

cyberhub.blogCVE-2026-101411Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterpris
CyberHub
@cyberhub.blog

📌 CVE-2026-96640 - Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tr... https://www.cyberhub.blog/cves/CVE-2026-96640

cyberhub.blogCVE-2026-96640Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes an attacker-controlled existing PDF whose
CyberHub
@cyberhub.blog

📌 CVE-2026-15723 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when O... https://www.cyberhub.blog/cves/CVE-2026-15723

cyberhub.blogCVE-2026-15723GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interact
CyberHub
@cyberhub.blog

📌 CVE-2026-116192 - rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstor... https://www.cyberhub.blog/cves/CVE-2026-116192

cyberhub.blogCVE-2026-116192rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-cho
CyberHub
@cyberhub.blog

📌 CVE-2026-91212 - Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). Supported versions that are aff... https://www.cyberhub.blog/cves/CVE-2026-91212

cyberhub.blogCVE-2026-91212Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac
CyberHub
@cyberhub.blog

📌 CVE-2026-91211 - Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server). Supported ve... https://www.cyberhub.blog/cves/CVE-2026-91211

cyberhub.blogCVE-2026-91211Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via SOAP
CyberHub
@cyberhub.blog

📌 CVE-2026-91492 - Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+). Supported versions that are affecte... https://www.cyberhub.blog/cves/CVE-2026-91492

cyberhub.blogCVE-2026-91492Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle
CyberHub
@cyberhub.blog

📌 CVE-2026-116191 - Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by s... https://www.cyberhub.blog/cves/CVE-2026-116191

cyberhub.blogCVE-2026-116191Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or d
CyberHub
@cyberhub.blog

📌 CVE-2026-91490 - Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are aff... https://www.cyberhub.blog/cves/CVE-2026-91490

cyberhub.blogCVE-2026-91490Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Orac
CyberHub
@cyberhub.blog

📌 CVE-2026-101420 - Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8... https://www.cyberhub.blog/cves/CVE-2026-101420

cyberhub.blogCVE-2026-101420Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Wh
CyberHub
@cyberhub.blog

📌 CVE-2026-91491 - Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are aff... https://www.cyberhub.blog/cves/CVE-2026-91491

cyberhub.blogCVE-2026-91491Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Orac
CyberHub
@cyberhub.blog

📌 CVE-2026-96639 - Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode... https://www.cyberhub.blog/cves/CVE-2026-96639

cyberhub.blogCVE-2026-96639Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the
CyberHub
@cyberhub.blog

📌 CVE-2026-110264 - An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.... https://www.cyberhub.blog/cves/CVE-2026-110264

cyberhub.blogCVE-2026-110264An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to exec
CyberHub
@cyberhub.blog

📌 German BSI Sets End of July Deadline for NIS2 Directive Registration Amid Low Compliance https://www.cyberhub.blog/article/27280-german-bsi-sets-end-of-july-deadline-for-nis2-directive-registration-amid-low-compliance

cyberhub.blogGerman BSI Sets End of July Deadline for NIS2 Directive Registration Amid Low ComplianceThe German Federal Office for Information Security (BSI) has set a new deadline of end of July for companies to register under the NIS2 Directive, an EU-wide cybersecurity regulation. The BSI issued the reminder due to disappointing registration numbers for the IT-Sicherheitsgesetz (IT Security Act), which enforces NIS2 compliance. The directive applies to critical infrastructure operators and essential service providers, mandating stricter security measures and incident reporting. No specific penalties or technical details about non-compliance were provided in the notice. The update follows previous warnings to ensure organizations meet regulatory obligations.
CyberHub
@cyberhub.blog

📌 AI Chat Links and Cloud Agents Exploited in Sophisticated Cyber Attacks https://www.cyberhub.blog/article/27287-ai-chat-links-and-cloud-agents-exploited-in-sophisticated-cyber-attacks

cyberhub.blogAI Chat Links and Cloud Agents Exploited in Sophisticated Cyber AttacksThreat actors abused AI chat links to distribute malware, turning legitimate interaction paths into infection vectors. Malicious browser add-ons were used to siphon user search data, while macOS attacks executed in memory with minimal forensic traces. Attackers exploited cloud agents by treating them as open command shells, bypassing intended functionality. The report also highlighted exposed edge network devices, poisoned npm packages under the 'NastyC2' campaign, and device-code phishing attacks. Additional threats included cash courier scams and 25 other undisclosed security incidents. No specific dates, CVE IDs, or technical indicators were provided in the summary.
CyberHub
@cyberhub.blog

📌 Unauthenticated Remote Control Vulnerability in Mitsubishi MAC-577IF-2E WiFi Adapters (CVE-2026-5667... https://www.cyberhub.blog/article/27290-unauthenticated-remote-control-vulnerability-in-mitsubishi-mac-577if-2e-wifi-adapters-cve-2026-5667

cyberhub.blogUnauthenticated Remote Control Vulnerability in Mitsubishi MAC-577IF-2E WiFi Adapters (CVE-2026-5667)The post details a vulnerability (CVE-2026-5667) affecting Mitsubishi MAC-577IF-2E WiFi adapters, allowing unauthenticated remote control. The exploit leverages probe request reconnaissance to manipulate the device. No additional technical specifics or mitigation steps are provided in the post.
CyberHub
@cyberhub.blog

📌 Research Exposes Vulnerabilities in Memory Encryption for Confidential Computing https://www.cyberhub.blog/article/27291-research-exposes-vulnerabilities-in-memory-encryption-for-confidential-computing

cyberhub.blogResearch Exposes Vulnerabilities in Memory Encryption for Confidential ComputingThe video presents research by Yoan Bulck (KU Leuven University) and Yes Master on vulnerabilities in memory encryption technologies used in confidential computing, a security paradigm adopted by major cloud providers and processor vendors like Intel, AMD, IBM, and ARM. The study highlights that while confidential computing relies on processor-level isolation and memory encryption to protect data, industry implementations often sacrifice integrity and freshness protections for scalability, leaving systems vulnerable to physical attacks. Researchers demonstrated two attack methods: 'BadRAM,' which exploits writable Serial Presence Detect (SPD) chips on memory modules to create physical memory aliases, and 'Battering RAM,' a $50 interposer-based attack that flips address bits at runtime to bypass boot-time mitigations. These attacks enabled arbitrary read/write access to protected memory regions, including the extraction of Intel’s hardware provisioning keys from SGX enclaves, compromising the entire scalable SGX ecosystem. The findings were responsibly disclosed to AMD and Intel, though both vendors dismissed physical attacks as out of scope, aligning with a French cybersecurity agency’s assessment that users must implicitly trust cloud providers and their supply chains. The research underscores that hardware-based attacks on confidential computing are now feasible with minimal resources, challenging the security guarantees of widely deployed technologies.
CyberHub
@cyberhub.blog

📌 Cisco Acquires WideField Security to Enhance Splunk’s Agentic SOC Capabilities https://www.cyberhub.blog/article/27296-cisco-acquires-widefield-security-to-enhance-splunks-agentic-soc-capabilities

cyberhub.blogCisco Acquires WideField Security to Enhance Splunk’s Agentic SOC CapabilitiesCisco has announced its acquisition of WideField Security to enhance Splunk’s Agentic Security Operations Center (SOC) capabilities. The acquisition aims to expand threat investigation capabilities by incorporating identity, credentials, sessions, and blast radius analysis into Splunk’s platform. No specific financial details, completion timeline, or technical metrics were disclosed in the announcement. WideField Security’s role will focus on accelerating the development of Agentic SOC features. The acquisition was reported by SecurityWeek without additional contextual or operational specifics.
CyberHub
@cyberhub.blog

📌 FortiBleed Vulnerability Exposes VPN Credentials of 73,000 Fortinet Firewalls Worldwide https://www.cyberhub.blog/article/27303-fortibleed-vulnerability-exposes-vpn-credentials-of-73000-fortinet-firewalls-worldwide

cyberhub.blogFortiBleed Vulnerability Exposes VPN Credentials of 73,000 Fortinet Firewalls WorldwideThe FortiBleed vulnerability has exposed VPN credentials associated with 73,000 Fortinet firewalls globally. The incident involves a data leak affecting Fortinet devices, specifically targeting VPN authentication details. No specific CVE ID, dates, or technical exploit mechanisms were provided in the reported content. The impact includes the potential compromise of sensitive VPN access credentials across affected systems. The article does not specify the geographic distribution or timeline of the exposure. The source of the leak is attributed to a flaw referred to as FortiBleed.
CyberHub
@cyberhub.blog

📌 RRSW CTF Sponsored by zSecurity: Update, Spoilers, and Extended Deadline https://www.cyberhub.blog/article/27304-rrsw-ctf-sponsored-by-zsecurity-update-spoilers-and-extended-deadline

cyberhub.blogRRSW CTF Sponsored by zSecurity: Update, Spoilers, and Extended DeadlineThe RRSW CTF, sponsored by zSecurity, focuses on developing skills in Linux shell navigation, decryption, digital forensics (including .e01 file analysis with tools like Autopsy), and incident response. The challenge is set in a simulated environment called Skunk O.S., where participants must recover and analyze forensic evidence left by a previous investigator. The competition includes MITRE ATT&CK techniques, requires participants to record a restore code, and provides commands for navigating the simulated system. The event has been extended until September 21st, with a call for volunteers to help build Season 3.
CyberHub
@cyberhub.blog

📌 Top 20 Cybersecurity Projects Ranked by Difficulty and Hireability Impact https://www.cyberhub.blog/article/27308-top-20-cybersecurity-projects-ranked-by-difficulty-and-hireability-impact

cyberhub.blogTop 20 Cybersecurity Projects Ranked by Difficulty and Hireability ImpactThe video ranks 20 cybersecurity projects by difficulty (from 'noob' to 'madhat') and evaluates their impact on hireability, learning value, and perceived 'coolness' using a custom scoring system. Key projects include contributing a detection rule to Sigma HQ (difficulty 6/10, hireability 9/10), reverse engineering malware with Yara/Sigma rules (difficulty 10/10, hireability 10/10), and disclosing a real vulnerability for a CVE (hireability 10/10). Tools highlighted include Elastic/Sentinel for log analysis, Ghidra for malware reverse engineering, MISP for threat intel automation, and Azure/AWS for cloud misconfiguration hunting. The presenter, a former hiring manager, emphasizes projects that demonstrate investigation skills (e.g., documenting attack chains) or real-world application (e.g., LLM prompt injection testing, mandated by the EU AI Act). Projects like Active Directory attack/defend labs and OAuth consent phishing demos target enterprise-relevant skills, while automated security tooling (e.g., custom vulnerability scanners) proves engineering capability. Scores for hireability range from 1/10 (portfolio websites) to 10/10 (CVE disclosures), with 'coolness' often inversely correlated to practical value. The video concludes that unique, open-source contributions or hands-on detection engineering work stand out to employers.
CyberHub
@cyberhub.blog

📌 Security Vulnerability Discovered in Traefik Allowing Policy Bypass https://www.cyberhub.blog/article/27312-security-vulnerability-discovered-in-traefik-allowing-policy-bypass

cyberhub.blogSecurity Vulnerability Discovered in Traefik Allowing Policy BypassA vulnerability was discovered in Traefik on June 19, 2026, allowing attackers to bypass security policies. The flaw specifically enables the circumvention of defined security measures within the affected software. No additional technical details, such as CVE identifiers, affected versions, or specific attack vectors, were provided in the notice. The impact is limited to the described security policy bypass, with no further consequences outlined. The advisory was published by CERT-FR under reference CERTFR-2026-AVI-0785.
CyberHub
@cyberhub.blog

📌 SOC1 Pathway Content Relevance for Certification Exam and Study Challenges https://www.cyberhub.blog/article/27318-soc1-pathway-content-relevance-for-certification-exam-and-study-challenges

cyberhub.blogSOC1 Pathway Content Relevance for Certification Exam and Study ChallengesThe post asks whether all content from the SOC1 pathway is necessary for the certification exam. The author finds earlier material understandable but struggles with the Data Exfiltration Detection room, particularly DNS tunneling queries, which feel unexplained and require copying commands without clear context. They question whether they should memorize every query in detail or return to the material later. The post also inquires if others rely on Google during the exam.
CyberHub
@cyberhub.blog

📌 Massive Data Leak Exposes 24 Billion Stolen Credentials in Unsecured Elasticsearch Cluster https://www.cyberhub.blog/article/27321-massive-data-leak-exposes-24-billion-stolen-credentials-in-unsecured-elasticsearch-cluster

cyberhub.blogMassive Data Leak Exposes 24 Billion Stolen Credentials in Unsecured Elasticsearch ClusterCybernews researchers discovered an exposed Elasticsearch cluster on June 12th containing 24 billion records and more than 8.3 terabytes of data. The database revealed stolen credentials from infostealers, Telegram channels, and breach collections, including passwords and emails. The researchers triple-checked the numbers to verify the scale of the exposure. The exposed data poses risks for account takeovers.
CyberHub
@cyberhub.blog

📌 NIS 2 Directive and Cloud Security Requirements Reshape Cybersecurity Obligations for Italian Organi... https://www.cyberhub.blog/article/27328-nis-2-directive-and-cloud-security-requirements-reshape-cybersecurity-obligations-for-italian-organizations

cyberhub.blogNIS 2 Directive and Cloud Security Requirements Reshape Cybersecurity Obligations for Italian OrganizationsThe NIS 2 Directive and cloud security requirements redefine cybersecurity obligations for thousands of Italian organizations, covering risk management, incident reporting, authentication, and supply chain security. Compliance is mandated under Italian Legislative Decree 138/2024, with operational deadlines for adaptation specified in the regulation. The Agency for National Cybersecurity (ACN) plays a key role in overseeing implementation and enforcement. Technical requirements include encryption, backup measures, cyber resilience, and data protection for digital infrastructures and service providers. The directive applies to entities operating in critical sectors, including digital service providers and data centers.
CyberHub
@cyberhub.blog

📌 Squidbleed: Heartbleed-style vulnerability in Squid Proxy leaks internal memory https://www.cyberhub.blog/article/27330-squidbleed-heartbleed-style-vulnerability-in-squid-proxy-leaks-internal-memory

cyberhub.blogSquidbleed: Heartbleed-style vulnerability in Squid Proxy leaks internal memorySquidbleed (CVE-2026-47729) is a Heartbleed-style vulnerability that leaks internal memory from every version of Squid Proxy, in its default configuration. The vulnerability affects all versions of Squid Proxy by default and allows the leakage of internal memory. It is described as similar to the Heartbleed bug. The post references a blog detailing the issue.
CyberHub
@cyberhub.blog

📌 International Operation Endgame Disrupts SocGholish Malware Infrastructure https://www.cyberhub.blog/article/27337-international-operation-endgame-disrupts-socgholish-malware-infrastructure

cyberhub.blogInternational Operation Endgame Disrupts SocGholish Malware InfrastructureOperation Endgame, a coordinated international law enforcement effort, disrupted the SocGholish malware infrastructure linked to the threat actor TA569 (also referenced as TA2726). The operation resulted in the takedown of over 100 command-and-control (C2) servers and the remediation of nearly 15,000 compromised websites. SocGholish, a JavaScript-based malware, was distributed through drive-by download attacks, often masquerading as fake software updates. Agencies including Europol and the FBI participated in the disruption, though no specific dates for the operation were provided. The action targeted the malware’s infrastructure but did not detail arrests or attribution beyond the threat actor designation.
CyberHub
@cyberhub.blog

📌 OpenBSD MPLS Kernel Stack Memory Leak Vulnerability (CVE-2026-56099) https://www.cyberhub.blog/article/27342-openbsd-mpls-kernel-stack-memory-leak-vulnerability-cve-2026-56099

cyberhub.blogOpenBSD MPLS Kernel Stack Memory Leak Vulnerability (CVE-2026-56099)A specially crafted MPLS packet can cause an out-of-bounds read in the `mpls_do_error` function, leaking 4 bytes of adjacent kernel stack memory. The leak occurs remotely and can be repeated if MPLS is enabled on the system. The vulnerability was fixed in OpenBSD-current on June 18, 2026.
CyberHub
@cyberhub.blog

📌 Gentlemen Ransomware Group Develops EDR Killers to Bypass Security Defenses https://www.cyberhub.blog/article/27345-gentlemen-ransomware-group-develops-edr-killers-to-bypass-security-defenses

cyberhub.blogGentlemen Ransomware Group Develops EDR Killers to Bypass Security DefensesThe Gentlemen ransomware-as-a-service (RaaS) operation is actively developing and maintaining multiple endpoint detection and response (EDR) killers to disable security defenses during attacks. These tools are provided to affiliates to evade detection and enhance the effectiveness of ransomware deployments. The group’s focus on EDR evasion suggests a targeted approach to bypassing modern cybersecurity protections. No specific technical details, CVE IDs, or dates were mentioned regarding the EDR killers or their functionality. The impact includes increased difficulty for organizations to detect and mitigate ransomware infections before encryption occurs.
CyberHub
@cyberhub.blog

📌 Critical Vulnerabilities Discovered in Google Pixel Devices https://www.cyberhub.blog/article/27352-critical-vulnerabilities-discovered-in-google-pixel-devices

cyberhub.blogCritical Vulnerabilities Discovered in Google Pixel DevicesMultiple vulnerabilities were discovered in Google Pixel devices as of June 19, 2026. These flaws enable attackers to achieve remote arbitrary code execution, privilege escalation, and remote denial-of-service attacks. The security notice was issued by the French government’s CERT (CERT-FR) under advisory CERTFR-2026-AVI-0779. No specific CVE identifiers, affected versions, or technical details about the vulnerabilities were provided in the notice. The impacts include unauthorized control over devices, elevated access, and disruption of services.
CyberHub
@cyberhub.blog

📌 Use-after-free vulnerability in nginx HTTP/3 QPACK encoder (CVE-2026-42530) https://www.cyberhub.blog/article/27355-use-after-free-vulnerability-in-nginx-http3-qpack-encoder-cve-2026-42530

cyberhub.blogUse-after-free vulnerability in nginx HTTP/3 QPACK encoder (CVE-2026-42530)The post references a vulnerability identified as CVE-2026-42530, which involves a use-after-free flaw in the QPACK encoder component of nginx when using HTTP/3. The issue is documented in an external research link provided in the post. No additional technical details or affected versions are explicitly stated in the post.
CyberHub
@cyberhub.blog

📌 Black Hat Presentation Highlights Security Risks in Python's Pickle Serialization and Introduces Saf... https://www.cyberhub.blog/article/27356-black-hat-presentation-highlights-security-risks-in-pythons-pickle-serialization-and-introduces-safer-pickle-tool

cyberhub.blogBlack Hat Presentation Highlights Security Risks in Python's Pickle Serialization and Introduces Safer Pickle ToolThe Black Hat presentation titled *Deal With It* explores security risks in Python’s *pickle* serialization format, widely used in AI/ML and data science for sharing datasets. Presenters George Litvinov and Andrew Johnston, both Google security engineers, demonstrate how unpickling untrusted files enables arbitrary code execution via the *reduce* opcode, which can invoke functions like *os.system*. They evaluate open-source pickle scanners, revealing bypass techniques such as invalid opcodes, nested pickles, and string reconstruction to evade detection. Their tool, *Safer Pickle*, addresses these gaps with a two-tiered architecture—emulating calls with dummy modules and performing opcode-level analysis—while allowing customizable allow/deny lists. The tool achieves ~10 MB/s scanning speed and integrates with VirusTotal, though the presenters emphasize that *pickle* remains inherently unsafe, recommending alternatives like *safe tensors*. Key takeaways include tailoring security solutions to specific environments and avoiding over-permissive allow lists. The project is open-source on GitHub under *Google/safer-pickle*.
CyberHub
@cyberhub.blog

📌 Cybersecurity Experts Warn of Hacking Networks Targeting FIFA World Cup 2026 Fans with Fraudulent Sc... https://www.cyberhub.blog/article/27361-cybersecurity-experts-warn-of-hacking-networks-targeting-fifa-world-cup-2026-fans-with-fraudulent-schemes

cyberhub.blogCybersecurity Experts Warn of Hacking Networks Targeting FIFA World Cup 2026 Fans with Fraudulent SchemesCybersecurity experts have identified active hacking networks targeting FIFA World Cup 2026 fans through fraudulent schemes, including fake hotel bookings, cloned websites, and live chat features designed to deceive victims. The scams aim to exploit fans seeking tickets and accommodations for the event, though no specific technical details, victim counts, or geographic targets were disclosed. The attacks involve phishing and social engineering tactics to steal personal and financial data. No malware strains, CVE IDs, or exact dates of campaign activity were mentioned. The primary impact includes financial fraud and potential privacy breaches for affected individuals.
CyberHub
@cyberhub.blog

📌 BlackFog Launches ADX Vision for macOS to Enhance AI Data-Loss Prevention https://www.cyberhub.blog/article/27368-blackfog-launches-adx-vision-for-macos-to-enhance-ai-data-loss-prevention

cyberhub.blogBlackFog Launches ADX Vision for macOS to Enhance AI Data-Loss PreventionBlackFog has released ADX Vision for macOS, extending its shadow AI detection, governance, and prevention platform to Apple endpoints. The tool enables enterprises to enforce a unified AI data-loss policy across both Windows and macOS devices to prevent sensitive data exfiltration via unsanctioned large language models (LLMs). This update addresses a critical gap in enterprise AI governance, as BlackFog’s research indicates widespread employee use of AI tools. The general availability of ADX Vision for macOS was announced without a specified release date. No technical specifications, CVE IDs, or quantified impacts were provided in the announcement.
CyberHub
@cyberhub.blog

📌 TryHackMe Launches AI Security Learning Pathway https://www.cyberhub.blog/article/27369-tryhackme-launches-ai-security-learning-pathway

cyberhub.blogTryHackMe Launches AI Security Learning PathwayThe post author, who works in AI product security engineering, expresses satisfaction that TryHackMe (THM) has introduced an AI security learning pathway. They mention the difficulty of finding reliable AI security certifications and trust THM based on past experience. The author plans to create writeups on their blog after completing specific AI-related rooms.