<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
     xmlns:dc="http://purl.org/dc/elements/1.1/"
     xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
     xmlns:admin="http://webns.net/mvcb/"
     xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
     xmlns:content="http://purl.org/rss/1.0/modules/content/"
     xmlns:media="http://search.yahoo.com/mrss/">
<channel>
<title>Latest News on Technology, Cryptocurrency, AI, and Cyber Security &#45; : Cyber Security</title>
<link>https://block385.com/rss/category/cybernews</link>
<description>Latest News on Technology, Cryptocurrency, AI, and Cyber Security &#45; : Cyber Security</description>
<dc:language>en</dc:language>
<dc:rights>2026 Block385.com</dc:rights>

<item>
<title>The Boring Stuff is Dangerous Now</title>
<link>https://block385.com/the-boring-stuff-is-dangerous-now</link>
<guid>https://block385.com/the-boring-stuff-is-dangerous-now</guid>
<description><![CDATA[ AI agents capable of discovering and exploiting obscure vulnerabilities are emerging alongside developers producing vast amounts of potentially flawed AI-generated code, forcing defenders to adapt accordingly. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blted41bae888a74bd1/6a0780b73c21f620148b9b52/cyberattack_fear_Yuri_Arcurs_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Boring, Stuff, Dangerous, Now</media:keywords>
</item>

<item>
<title>Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access</title>
<link>https://block385.com/turla-turns-kazuar-backdoor-into-modular-p2p-botnet-for-persistent-access</link>
<guid>https://block385.com/turla-turns-kazuar-backdoor-into-modular-p2p-botnet-for-persistent-access</guid>
<description><![CDATA[ The Russian state-sponsored hacking group known as
  
    Turla
  
  has transformed its custom backdoor Kazuar into a modular peer-to-peer (P2P) botnet that&#039;s engineered for stealth and persistent access to compromised hosts.



  Turla, per the U.S. Cybersecurity and Infrastructure Security Agency (CISA), is assessed to be affiliated with Center 16 of Russia&#039;s Federal Security Service (FSB) ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8BT1AOScncZQM_A-0WBdCzTDAHGHSey48_Mywhij-TJupCdzP3s3o-MIImRtMZcoV2OqX3RjRV4COpVqkB1mrH3d_zjwvSTwCEXOq_2m80HgDo-xwAZ1KpR1h8eN9dAHGcKN_PpcE0cBsnv67FcthDycHLBJMYs8NkPszWNiQqdbhyL0YIlwVJn4NtgaR/s1600/code.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 20:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Turla, Turns, Kazuar, Backdoor, Into, Modular, P2P, Botnet, for, Persistent, Access</media:keywords>
</item>

<item>
<title>Taiwan Bullet Train Hack Highlights Cybersecurity Gaps in Rail Systems</title>
<link>https://block385.com/taiwan-bullet-train-hack-highlights-cybersecurity-gaps-in-rail-systems</link>
<guid>https://block385.com/taiwan-bullet-train-hack-highlights-cybersecurity-gaps-in-rail-systems</guid>
<description><![CDATA[ A Taiwanese student experimenting with software-defined radio technology shut down three bullet trains for nearly an hour, leading to an anti-terrorism response. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltba3a137dbf767ae6/6a061f2f41bd583c0c8882d7/taiwan-bullet-trains-eric1207cvb-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 19:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Taiwan, Bullet, Train, Hack, Highlights, Cybersecurity, Gaps, Rail, Systems</media:keywords>
</item>

<item>
<title>Congress Puts Heat on Instructure After Canvas Outage</title>
<link>https://block385.com/congress-puts-heat-on-instructure-after-canvas-outage</link>
<guid>https://block385.com/congress-puts-heat-on-instructure-after-canvas-outage</guid>
<description><![CDATA[ The House Committee on Homeland Security sent a letter about the Canvas cyberattack, the same day that the edtech company said it reached an &quot;agreement&quot; with the ShinyHunters cybercriminals. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltb9f102c416e36970/6a062de47896f162656ad15c/canvas_pictoKraft_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 19:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Congress, Puts, Heat, Instructure, After, Canvas, Outage</media:keywords>
</item>

<item>
<title>Four OpenClaw Flaws Enable Data Theft, Privilege Escalation, and Persistence</title>
<link>https://block385.com/four-openclaw-flaws-enable-data-theft-privilege-escalation-and-persistence</link>
<guid>https://block385.com/four-openclaw-flaws-enable-data-theft-privilege-escalation-and-persistence</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed a set of four security flaws in OpenClaw that could be chained to achieve data theft, privilege escalation, and persistence.


  The vulnerabilities, collectively dubbed
  
    Claw Chain
  
  by Cyera, can permit an attacker to establish a foothold, expose sensitive data, and plant backdoors. A brief description of the flaws is below - ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgz_tK9S8jS_n5CK694-FLGjQP5_Mmpg7z9ZRiBayWsJLsuFRIm-8j1hTlhH90779FvnvhpiFKeGP9CzI5RCPsxQEnOzAIQsPzUsAJhUWtNm9iwf9C1W9DbDmqoQ_jjHhM7huYDV210OB9o1L9NPoJ0IL6R9Xc-V4JQ91Kn-b47_2ravRJ6-qlZOVrqsuAz/s1600/openclaw.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 18:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Four, OpenClaw, Flaws, Enable, Data, Theft, Privilege, Escalation, and, Persistence</media:keywords>
</item>

<item>
<title>Cisco patches another actively exploited SD&#45;WAN zero&#45;day (CVE&#45;2026&#45;20182)</title>
<link>https://block385.com/cisco-patches-another-actively-exploited-sd-wan-zero-day-cve-2026-20182</link>
<guid>https://block385.com/cisco-patches-another-actively-exploited-sd-wan-zero-day-cve-2026-20182</guid>
<description><![CDATA[ Cisco has patched yet another Catalyst SD-WAN Controller authentication bypass vulnerability (CVE-2026-20182) that has been exploited as a zero-day by “a highly sophisticated cyber threat actor”. About CVE-2026-20182 CVE-2026-20182 – affecting both Cisco Catalyst SD-WAN Controller (the “brain” of the Cisco Catalyst SD-WAN solution) and Cisco Catalyst SD-WAN Manager (the management plane for the entire SD-WAN fabric) – stems from a flawed peering authentication mechanism. It affects both on-prem and cloud deployments. CVE-2026-20182 was reported … More →
The post Cisco patches another actively exploited SD-WAN zero-day (CVE-2026-20182) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/15100810/cisco-lines-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 15:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cisco, patches, another, actively, exploited, SD-WAN, zero-day, CVE-2026-20182</media:keywords>
</item>

<item>
<title>Akamai to acquire LayerX for $205 million</title>
<link>https://block385.com/akamai-to-acquire-layerx-for-205-million</link>
<guid>https://block385.com/akamai-to-acquire-layerx-for-205-million</guid>
<description><![CDATA[ Akamai has entered into a definitive agreement to acquire LayerX, a provider of browser-based AI usage control and secure enterprise browser (SEB) technology. LayerX’s solutions will extend Akamai’s protection into the browser, where the majority of enterprise tasks now occur and where today’s workforce engages with generative AI applications, SaaS AI solutions, and AI agents. With this acquisition, Akamai is taking a critical step in the evolution of its zero trust security portfolio and addressing … More →
The post Akamai to acquire LayerX for $205 million appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 15:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Akamai, acquire, LayerX, for, 205, million</media:keywords>
</item>

<item>
<title>Google lets Workspace admins apply one policy across all SAML apps</title>
<link>https://block385.com/google-lets-workspace-admins-apply-one-policy-across-all-saml-apps</link>
<guid>https://block385.com/google-lets-workspace-admins-apply-one-policy-across-all-saml-apps</guid>
<description><![CDATA[ Google has updated Context-Aware Access (CAA) in Google Workspace to introduce a default policy assignment for SAML applications. SAML applications are third-party or internal applications that use the Security Assertion Markup Language (SAML) protocol to enable single sign-on (SSO) with Google Workspace credentials. Google says this update introduces a default assignment that serves as a universal security baseline, automatically protecting any SAML-based application that does not have a specific policy already assigned. By establishing this … More →
The post Google lets Workspace admins apply one policy across all SAML apps appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/10114613/google-lock-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 15:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, lets, Workspace, admins, apply, one, policy, across, all, SAML, apps</media:keywords>
</item>

<item>
<title>Cyber Pioneers Ponder Past as Prologue</title>
<link>https://block385.com/cyber-pioneers-ponder-past-as-prologue</link>
<guid>https://block385.com/cyber-pioneers-ponder-past-as-prologue</guid>
<description><![CDATA[ Robert &quot;RSnake&quot; Hansen, Katie Moussouris, Rich Mogull, Richard Stiennon, and Bruce Schneier reflect on how their favorite columns penned for Dark Reading over the past 20 years have stood the test of time. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6c991c2f510526e0/6a060dc5384002716e815d4f/typewriter_and_mobile_phone_mauritius_images_GmbH_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 15:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cyber, Pioneers, Ponder, Past, Prologue</media:keywords>
</item>

<item>
<title>What 45 Days of Watching Your Own Tools Will Tell You About Your Real Attack Surface</title>
<link>https://block385.com/what-45-days-of-watching-your-own-tools-will-tell-you-about-your-real-attack-surface</link>
<guid>https://block385.com/what-45-days-of-watching-your-own-tools-will-tell-you-about-your-real-attack-surface</guid>
<description><![CDATA[ In Your Biggest Security Risk Isn&#039;t Malware — It&#039;s What You Already Trust, we made a simple argument: the most dangerous activity inside most organizations no longer looks like an attack. It looks like administration. PowerShell, WMIC, netsh, Certutil, MSBuild — the same trusted utilities your IT team uses every day are also the preferred toolkit of modern threat actors. Bitdefender&#039;s analysis ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVcSUDrpIZyFrHqIlIGnXfIShsEamRNviaM6TguPwmQI9KkhrIXOQbQ0WVKiOkcBGkFqKTKZmK16zPChmlcCbZHIkX3K_C0sjnyXYJjpZuJXO3OiIhUe7Ez8jCNiTxh0FGYS2-RR6HKsl9pWJVgc_uXAtHXj0hgU-mLSsOh-QHft6A92KtgWPQhk1OVPA/s1600/Attack-Surface.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>What, Days, Watching, Your, Own, Tools, Will, Tell, You, About, Your, Real, Attack, Surface</media:keywords>
</item>

<item>
<title>TanStack Supply Chain Attack Hits Two OpenAI Employee Devices, Forces macOS Updates</title>
<link>https://block385.com/tanstack-supply-chain-attack-hits-two-openai-employee-devices-forces-macos-updates</link>
<guid>https://block385.com/tanstack-supply-chain-attack-hits-two-openai-employee-devices-forces-macos-updates</guid>
<description><![CDATA[ OpenAI has disclosed that two of its employee devices in its corporate environment were impacted via the Mini Shai-Hulud supply chain attack on TanStack, but noted that no user data, production systems, or intellectual property were compromised or modified in an unauthorized manner.
&quot;Upon identification of the malicious activity, we worked quickly to investigate, contain, and take steps to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1l4Vq20M4553fkDfGbO9VqLV9Au-6EefivLp8HT2W5QxJvgWf1mr6pg5xsbC5j3FCJzOOCJv_CImY1LjjFYIN_25ajki1iS_EVPvTyeVY7bC3ogcQFzHmE1Xyaz3cRXneilC0rWcb8dLbUapLI_jZ-uBaUkku48absoxM6TG16jS3xxtw9lhhtCvJmemK/s1600/chatgpt.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TanStack, Supply, Chain, Attack, Hits, Two, OpenAI, Employee, Devices, Forces, macOS, Updates</media:keywords>
</item>

<item>
<title>Rocky Linux launches opt&#45;in security repository for urgent fixes</title>
<link>https://block385.com/rocky-linux-launches-opt-in-security-repository-for-urgent-fixes</link>
<guid>https://block385.com/rocky-linux-launches-opt-in-security-repository-for-urgent-fixes</guid>
<description><![CDATA[ Rocky Linux has introduced a Security Repository that allows the distribution to ship urgent security fixes ahead of upstream Enterprise Linux when public exploit code exists and upstream patches are unavailable. “The repository is disabled by default. That’s intentional. The default Rocky Linux experience stays exactly what it has always been: predictable, stable, and fully upstream-compatible. Administrators who want access to accelerated fixes can opt in when they need it,” Eric Hendricks of the Rocky … More →
The post Rocky Linux launches opt-in security repository for urgent fixes appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/15113413/rocky_linux-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 13:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Rocky, Linux, launches, opt-in, security, repository, for, urgent, fixes</media:keywords>
</item>

<item>
<title>Unpatched Microsoft Exchange Server vulnerability exploited (CVE&#45;2026&#45;42897)</title>
<link>https://block385.com/unpatched-microsoft-exchange-server-vulnerability-exploited-cve-2026-42897</link>
<guid>https://block385.com/unpatched-microsoft-exchange-server-vulnerability-exploited-cve-2026-42897</guid>
<description><![CDATA[ A critical cross-site scripting (XSS) vulnerability (CVE-2026-42897) in Microsoft Exchange Server is being exploited by attackers, Microsoft warned on Thursday. A permanent fix is still in the works. In the meantime, Microsoft provided temporary mitigations. About CVE-2026-42897 CVE-2026-42897 affects on-premises versions of Microsoft Exchange Server: Subscription Edition RTM, 2019, and 2016. Exchange Online is not affected. Flagged by an anonymous researcher, the vulnerability allows an unauthorized attacker to perform spoofing over a network. “An attacker … More →
The post Unpatched Microsoft Exchange Server vulnerability exploited (CVE-2026-42897) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/05/28084624/microsoft_exchange_1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 13:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Unpatched, Microsoft, Exchange, Server, vulnerability, exploited, CVE-2026-42897</media:keywords>
</item>

<item>
<title>Thieves unlock stolen iPhones using cheap tools sold on Telegram</title>
<link>https://block385.com/thieves-unlock-stolen-iphones-using-cheap-tools-sold-on-telegram</link>
<guid>https://block385.com/thieves-unlock-stolen-iphones-using-cheap-tools-sold-on-telegram</guid>
<description><![CDATA[ Helping a friend recover a stolen phone, Infoblox researchers uncovered a thriving Telegram-based underground marketplace selling unlocking tools and phishing infrastructure used to monetize stolen iPhones. Activation Lock can remotely disable a stolen iPhone and prevent normal resale, with owners also able to lock individual components. Even with those protections, more than 7.35 million iPhones are reportedly stolen each year in the United States alone. “A locked device is almost worthless on the black market, … More →
The post Thieves unlock stolen iPhones using cheap tools sold on Telegram appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/01/30083802/apple-map-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 13:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Thieves, unlock, stolen, iPhones, using, cheap, tools, sold, Telegram</media:keywords>
</item>

<item>
<title>Keycard helps developers secure autonomous AI agents with scoped access</title>
<link>https://block385.com/keycard-helps-developers-secure-autonomous-ai-agents-with-scoped-access</link>
<guid>https://block385.com/keycard-helps-developers-secure-autonomous-ai-agents-with-scoped-access</guid>
<description><![CDATA[ Keycard has announced Keycard for Multi-Agent Apps, extending its platform to support delegated, session-based access across systems of autonomous agents. Keycard lets developers build apps where every agent has its own identity, access is scoped to each task and every action is fully attributable across agents, users and systems. “Enterprises are rebuilding business functions around AI agents. Right now the developers building these systems have to choose: give agents broad access and they’re ungovernable or … More →
The post Keycard helps developers secure autonomous AI agents with scoped access appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 11:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Keycard, helps, developers, secure, autonomous, agents, with, scoped, access</media:keywords>
</item>

<item>
<title>On&#45;Prem Microsoft Exchange Server CVE&#45;2026&#45;42897 Exploited via Crafted Email</title>
<link>https://block385.com/on-prem-microsoft-exchange-server-cve-2026-42897-exploited-via-crafted-email</link>
<guid>https://block385.com/on-prem-microsoft-exchange-server-cve-2026-42897-exploited-via-crafted-email</guid>
<description><![CDATA[ Microsoft has disclosed a new security vulnerability impacting on-premise versions of Exchange Server that it said has come under active exploitation in the wild.
The vulnerability, tracked as CVE-2026-42897 (CVSS score: 8.1), has been described as a spoofing bug stemming from a cross-site scripting flaw. An anonymous researcher has been credited with discovering and reporting the issue.
&quot; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirN79ZRjEd5wnVbOTlJJsWjQ54cwSj2bM5NDzBSgAFO8f_9LrlIwQRI0ZogQX42iejmhgc1n2YcA91pFrVqtqNKKyAIXblcQ1Yx9LTs1TeNDbNN6JMUBXCKDK1W0IwnwvYl1dhQmcyTPHwakckKT_Kc9fAUDAJRj94g2pENrjy4UyTCCniOXI2rO-q66PC/s1600/Microsoft-Exchange.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>On-Prem, Microsoft, Exchange, Server, CVE-2026-42897, Exploited, via, Crafted, Email</media:keywords>
</item>

<item>
<title>Zombie linkages are keeping expired domains trusted for years</title>
<link>https://block385.com/zombie-linkages-are-keeping-expired-domains-trusted-for-years</link>
<guid>https://block385.com/zombie-linkages-are-keeping-expired-domains-trusted-for-years</guid>
<description><![CDATA[ Domains expire, get transferred, and return to the market every day. The systems connected to those domains can continue trusting the original owner long after control has changed. Researchers at USC and the University of Twente examined this problem in three widely used systems: Web PKI, Maven Central, and Ethereum Name Service. They use the term “zombie linkages” to describe lingering trust records that remain active after the original domain owner no longer controls the … More →
The post Zombie linkages are keeping expired domains trusted for years appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/22100811/domain_security-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 09:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Zombie, linkages, are, keeping, expired, domains, trusted, for, years</media:keywords>
</item>

<item>
<title>Deepfake detection is losing ground to generative models</title>
<link>https://block385.com/deepfake-detection-is-losing-ground-to-generative-models</link>
<guid>https://block385.com/deepfake-detection-is-losing-ground-to-generative-models</guid>
<description><![CDATA[ Deepfake detection has been built around a single question for close to a decade. Given a video or audio clip, is it real or synthetic? Commercial detectors analyze pixels, frequencies, and biometric signals to answer that question, and the best of them post strong accuracy numbers on standard benchmarks. In deployment, performance drops sharply on content from newer generators. Researchers at the Vector Institute think this gap is structural, and closing it means rethinking what … More →
The post Deepfake detection is losing ground to generative models appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/12150122/face-person-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 09:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Deepfake, detection, losing, ground, generative, models</media:keywords>
</item>

<item>
<title>CISA Adds Cisco SD&#45;WAN CVE&#45;2026&#45;20182 to KEV After Admin Access Exploits</title>
<link>https://block385.com/cisa-adds-cisco-sd-wan-cve-2026-20182-to-kev-after-admin-access-exploits</link>
<guid>https://block385.com/cisa-adds-cisco-sd-wan-cve-2026-20182-to-kev-after-admin-access-exploits</guid>
<description><![CDATA[ The U.S.Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a newly disclosed vulnerability impacting Cisco Catalyst SD-WAN Controller to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate the issue by May 17, 2026.
The vulnerability is a critical authentication bypass tracked as CVE-2026-20182. It&#039;s ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4XG5z00sF3uL0ZbhtZNiergQ9QVaZJydwP1pXEdPh2o29mwvTS2nPKRbxHftwnEJ1pvxMQS9TQknWqbovk-vW7BRPHUSsBhN4yL2iOwJnlmK7lzCdW9tJbKtKLbnfSZSWgfGlWQ6HO807gjR6dP61VylH1zxWtvfo3c7ui8aBecSjVz5miCG0jHoa8rUA/s1600/cisa-exploit.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 08:30:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, Adds, Cisco, SD-WAN, CVE-2026-20182, KEV, After, Admin, Access, Exploits</media:keywords>
</item>

<item>
<title>The AI oversight paradox: Is the investment worth the cost of watching it?</title>
<link>https://block385.com/the-ai-oversight-paradox-is-the-investment-worth-the-cost-of-watching-it</link>
<guid>https://block385.com/the-ai-oversight-paradox-is-the-investment-worth-the-cost-of-watching-it</guid>
<description><![CDATA[ Unlike in 2025, when AI adoption and testing drove business strategies, organizations in 2026 want proven ROI before committing budgets, according to a report by Globalization Partners. How global executives characterize their organization’s approach to AI adoption (Source: Globalization Partners) 62% of business leaders said they felt pressure from their organizations to use AI, while only 38% found AI tools personally beneficial. Companies also began building in-house solutions to address security and compliance requirements. “A … More →
The post The AI oversight paradox: Is the investment worth the cost of watching it? appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/04/04143313/question.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 07:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, oversight, paradox:, the, investment, worth, the, cost, watching, it</media:keywords>
</item>

<item>
<title>New infosec products of the week: May 15, 2026</title>
<link>https://block385.com/new-infosec-products-of-the-week-may-15-2026</link>
<guid>https://block385.com/new-infosec-products-of-the-week-may-15-2026</guid>
<description><![CDATA[ Here’s a look at the most interesting products from the past week Alation, Apricorn, Versa Networks, and TrustCloud. The questionnaire-based TPRM model is broken, and TrustCloud has a fix TrustCloud announced a new version of TrustLens, its third party risk management (TPRM) solution. The new TrustLens agentic AI capabilities focus on delivering four requirements every CISO wants in their TPRM program: speed, accuracy, coverage, and proactive risk mitigation. Alation AI Governance creates a system of … More →
The post New infosec products of the week: May 15, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/28091843/infosec-week-1200.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 07:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, infosec, products, the, week:, May, 15, 2026</media:keywords>
</item>

<item>
<title>Taiwan Incident Highlights Cybersecurity Gaps in Rail Systems</title>
<link>https://block385.com/taiwan-incident-highlights-cybersecurity-gaps-in-rail-systems</link>
<guid>https://block385.com/taiwan-incident-highlights-cybersecurity-gaps-in-rail-systems</guid>
<description><![CDATA[ A Taiwanese student experimenting with software-defined radio technology shut down three bullet trains for nearly an hour, leading to an anti-terrorism response. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltba3a137dbf767ae6/6a061f2f41bd583c0c8882d7/taiwan-bullet-trains-eric1207cvb-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 05:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Taiwan, Incident, Highlights, Cybersecurity, Gaps, Rail, Systems</media:keywords>
</item>

<item>
<title>SecurityScorecard Snags Driftnet to Level Up Threat Intelligence</title>
<link>https://block385.com/securityscorecard-snags-driftnet-to-level-up-threat-intelligence</link>
<guid>https://block385.com/securityscorecard-snags-driftnet-to-level-up-threat-intelligence</guid>
<description><![CDATA[ The acquisition looks to boost visibility into third-party ecosystems, which are becoming a bigger concern as vectors for supply chain attacks. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltfcc8475497281343/67e40db954e011810a508de7/threat_intelligence_(1800)_Futuristic_overlay_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 15 May 2026 01:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SecurityScorecard, Snags, Driftnet, Level, Threat, Intelligence</media:keywords>
</item>

<item>
<title>Maximum Severity Cisco SD&#45;WAN Bug Exploited in the Wild</title>
<link>https://block385.com/maximum-severity-cisco-sd-wan-bug-exploited-in-the-wild</link>
<guid>https://block385.com/maximum-severity-cisco-sd-wan-bug-exploited-in-the-wild</guid>
<description><![CDATA[ This is the second time this year a threat actor has leveraged a CVSS 10.0 vulnerability in Cisco&#039;s network control system. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt413a34f746df538e/6a0626f76111611c85c510d8/Cisco-MTP-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Maximum, Severity, Cisco, SD-WAN, Bug, Exploited, the, Wild</media:keywords>
</item>

<item>
<title>Cisco Catalyst SD&#45;WAN Controller Auth Bypass Actively Exploited to Gain Admin Access</title>
<link>https://block385.com/cisco-catalyst-sd-wan-controller-auth-bypass-actively-exploited-to-gain-admin-access</link>
<guid>https://block385.com/cisco-catalyst-sd-wan-controller-auth-bypass-actively-exploited-to-gain-admin-access</guid>
<description><![CDATA[ Cisco has released updates to address a maximum-severity authentication bypass flaw in Catalyst SD-WAN Controller that it said has been exploited in limited attacks.
The vulnerability, tracked as CVE-2026-20182, carries a CVSS score of 10.0.
&quot;A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9rok1ToP_K0gWug0GnICltZkvx6bMRyhHfTJG1AcSfrGpM_fOVc61O3Fpyen_IW-wpb4s6Hl3qZcU5nEs77SMWSpKNDR4rrlY2syVVSNEBrpHx8RkWmYaN9MZORNICc8LNhuNjXqqhxmy7JN-y389oyQnAAFoBMJC1NoQSQFaOZ2MnrpKQRfv_eYXIoWI/s1600/cisco-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 22:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cisco, Catalyst, SD-WAN, Controller, Auth, Bypass, Actively, Exploited, Gain, Admin, Access</media:keywords>
</item>

<item>
<title>Stealer Backdoor Found in 3 Node&#45;IPC Versions Targeting Developer Secrets</title>
<link>https://block385.com/stealer-backdoor-found-in-3-node-ipc-versions-targeting-developer-secrets</link>
<guid>https://block385.com/stealer-backdoor-found-in-3-node-ipc-versions-targeting-developer-secrets</guid>
<description><![CDATA[ Cybersecurity researchers are sounding the alarm about what has been described as &quot;malicious activity&quot; in newly published versions of node-ipc.
According to Socket and StepSecurity, three different versions of the npm package have been confirmed as malicious -

node-ipc@9.1.6
node-ipc@9.2.3
node-ipc@12.0.1

&quot;Early analysis indicates that node-ipc@9.1.6, node-ipc@9.2.3, and node-ipc@12.0.1 ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTj2m9-HHmDEDzKIsalsJ_HJcwcUsIFajvcpTLP9QMyqS9F_JroTH7lXeOGZFuO6j6F-RzbIo1kBIQ0udSFQGzjN2hxO8ZfyFeHM5557BPI1sjiJ7cEMJJE62t11e07Wt1CsmAntpLHSM0XbnQDvVYNBfNdAOsob9kN6G6-mQjKX68fEE1nzy_Bn4TvxyK/s1600/node.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 22:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Stealer, Backdoor, Found, Node-IPC, Versions, Targeting, Developer, Secrets</media:keywords>
</item>

<item>
<title>ThreatsDay Bulletin: PAN&#45;OS RCE, Mythos cURL Bug, AI Tokenizer Attacks, and 10+ Stories</title>
<link>https://block385.com/threatsday-bulletin-pan-os-rce-mythos-curl-bug-ai-tokenizer-attacks-and-10-stories</link>
<guid>https://block385.com/threatsday-bulletin-pan-os-rce-mythos-curl-bug-ai-tokenizer-attacks-and-10-stories</guid>
<description><![CDATA[ Everything is still on fire.
This week feels dumb in the worst way — bad links, weak checks, fake help desks, shady forum posts, and people turning supply chain attacks into some cursed little game for clout and cash. Half of it feels new. Half of it feels like crap we should have fixed years ago.
The mess keeps getting louder: users get tricked, boxes get popped, tools meant for normal work ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjImYNT-qC7frGzEXeok3KDX_JNMKote6V1FVXIpkAoSEER2z1YyT8dpFq5RtRhBQ0cweEPbBIuioDWFf5rw_Mf-0V6rXR2ZrMh2ISDa7X7NlV9zIGsoLSAnyd_86eVkrR4wU24yxbuCYaAmyGFwlF77YCjvgU3n43P-yFT-pzjsmQ35Oaut1klg62bs_-i/s1600/threatsday-2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ThreatsDay, Bulletin:, PAN-OS, RCE, Mythos, cURL, Bug, Tokenizer, Attacks, and, 10, Stories</media:keywords>
</item>

<item>
<title>&amp;apos;FrostyNeighbor&amp;apos; APT Carefully Targets Govt Orgs in Poland, Ukraine</title>
<link>https://block385.com/frostyneighbor-apt-carefully-targets-govt-orgs-in-poland-ukraine</link>
<guid>https://block385.com/frostyneighbor-apt-carefully-targets-govt-orgs-in-poland-ukraine</guid>
<description><![CDATA[ Attackers uniquely fingerprint victims before delivering spear-phishing payloads aimed at espionage, in the latest campaign from the Belarussian nation-state threat group. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf983cc244eaa1c16/6a04800d239afae8d4940268/Frost_Piotr_Malczyk_AlamyStockPhoto.png" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 19:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>FrostyNeighbor, APT, Carefully, Targets, Govt, Orgs, Poland, Ukraine</media:keywords>
</item>

<item>
<title>Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike</title>
<link>https://block385.com/ghostwriter-targets-ukrainian-government-with-geofenced-pdf-phishing-cobalt-strike</link>
<guid>https://block385.com/ghostwriter-targets-ukrainian-government-with-geofenced-pdf-phishing-cobalt-strike</guid>
<description><![CDATA[ The Belarus-aligned threat group known as Ghostwriter has been attributed to a fresh set of attacks targeting governmental organizations in Ukraine.
Active since at least 2016, Ghostwriter has been linked to both cyber espionage and influence operations targeting neighboring countries, particularly Ukraine. It&#039;s also tracked under the monikers FrostyNeighbor, PUSHCHA, Storm-0257, TA445, UAC‑0057 ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEld5BcqD9rYWVjx7o_XlV5pN_9djvilow0iIYP-LlFEzGReX8fTPZ0gKi9zMGVLTT8qddHu5FyBMaZpQroEzYFpsoPWf96hD7JeTdqsROemmavXW2pDxNwc9kjvpJdhahmXA5Ng88tN1lyO5rqzC3K6JNwPFPWBo7OzSsaiQIN8JJsXvMrGhewMfzpouF/s1600/uk.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 18:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ghostwriter, Targets, Ukrainian, Government, With, Geofenced, PDF, Phishing, Cobalt, Strike</media:keywords>
</item>

<item>
<title>Fragnesia: New Linux kernel LPE bug was spawned by Dirty Frag patch (CVE&#45;2026&#45;46300)</title>
<link>https://block385.com/fragnesia-new-linux-kernel-lpe-bug-was-spawned-by-dirty-frag-patch-cve-2026-46300</link>
<guid>https://block385.com/fragnesia-new-linux-kernel-lpe-bug-was-spawned-by-dirty-frag-patch-cve-2026-46300</guid>
<description><![CDATA[ Researchers have found and disclosed yet another local privilege escalation (LPE) vulnerability in the Linux kernel: CVE-2026-46300, aka “Fragnesia”. The flaw is in the same class of vulnerabilities as the recently disclosed Dirty Frag bug(s). Like Dirty Frag, it affects the same Linux module (xfrm-ESP). In fact, according to Dirty Frag discoverer Hyunwoo Kim, Fragnesia was “accidentally activated” by the patch fixing one of the original Dirty Frag vulnerabilities (i.e., CVE-2026-43284). CVE-2026-46300 explained Fragnesia was … More →
The post Fragnesia: New Linux kernel LPE bug was spawned by Dirty Frag patch (CVE-2026-46300) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/14160504/tux-1500-1.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 17:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fragnesia:, New, Linux, kernel, LPE, bug, was, spawned, Dirty, Frag, patch, CVE-2026-46300</media:keywords>
</item>

<item>
<title>HYCU  aiR detects insider risk and AI activity from backups</title>
<link>https://block385.com/hycu-air-detects-insider-risk-and-ai-activity-from-backups</link>
<guid>https://block385.com/hycu-air-detects-insider-risk-and-ai-activity-from-backups</guid>
<description><![CDATA[ HYCU has announced HYCU aiR (AI Resilience), an AI-native solution that turns backup data across dozens of applications into a live and actionable intelligence for security, compliance, and IT teams. aiR lets organizations search, query, and run purpose-built agents to surface insider risk, sensitive data exposure, identity drift, and AI agent activity, using their backup data. Every backup is a timestamped record of what happened inside an organization’s applications. HYCU aiR is the first solution … More →
The post HYCU  aiR detects insider risk and AI activity from backups appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 17:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>HYCU, aiR, detects, insider, risk, and, activity, from, backups</media:keywords>
</item>

<item>
<title>Checkbox Assessments Aren&amp;apos;t Fit to Measure Risk</title>
<link>https://block385.com/checkbox-assessments-arent-fit-to-measure-risk</link>
<guid>https://block385.com/checkbox-assessments-arent-fit-to-measure-risk</guid>
<description><![CDATA[ Security governance needs to be more than an annual compliance exercise. New companies are emerging to address risk-management gaps in current audit tools. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt730562b46d0b78c5/66be4145fa2d5811b851cb52/Risk(1800)_Andriy_Popov_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 17:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Checkbox, Assessments, Arent, Fit, Measure, Risk</media:keywords>
</item>

<item>
<title>AI Drives Cybersecurity Investments, Widening &amp;apos;Valley of Death&amp;apos;</title>
<link>https://block385.com/ai-drives-cybersecurity-investments-widening-valley-of-death</link>
<guid>https://block385.com/ai-drives-cybersecurity-investments-widening-valley-of-death</guid>
<description><![CDATA[ In a role reversal, investment dollars in AI security startups exceeded the value of AI acquisitions in 1Q26 by more than $1 billion, a rare occurrence. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt8d0adcdfb0592b29/6a023182733969819914d590/venturecapital_AlekseyFuntap_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 15:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Drives, Cybersecurity, Investments, Widening, Valley, Death</media:keywords>
</item>

<item>
<title>Foxconn Attack Highlights Manufacturing&amp;apos;s Cyber Crisis</title>
<link>https://block385.com/foxconn-attack-highlights-manufacturings-cyber-crisis</link>
<guid>https://block385.com/foxconn-attack-highlights-manufacturings-cyber-crisis</guid>
<description><![CDATA[ A Nitrogen ransomware attack on Foxconn&#039;s North American facilities is one of 600 hits on manufacturers this year, as gangs increasingly target the sector for its low tolerance for downtime. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt2bde2506b3de4da9/6a04dd5c239afae6399403b6/foxconn_ada_Images_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 15:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Foxconn, Attack, Highlights, Manufacturings, Cyber, Crisis</media:keywords>
</item>

<item>
<title>Cofense  adds AI&#45;powered campaign detection to stop phishing attacks</title>
<link>https://block385.com/cofense-adds-ai-powered-campaign-detection-to-stop-phishing-attacks</link>
<guid>https://block385.com/cofense-adds-ai-powered-campaign-detection-to-stop-phishing-attacks</guid>
<description><![CDATA[ Cofense has announced new advancements to its Phishing Defense Platform aimed at improving detection and response to AI-powered phishing attacks. The updates include AI-driven phishing detection, enhanced triage automation, and AI-assisted training campaign creation designed to strengthen protection across the phishing lifecycle. Phishing threats are no longer one-off emails. Attackers launch coordinated, polymorphic campaigns that deliberately vary content, senders, and delivery patterns to evade both traditional and AI-only detection approaches. The Cofense platform combines AI … More →
The post Cofense  adds AI-powered campaign detection to stop phishing attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 15:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cofense, adds, AI-powered, campaign, detection, stop, phishing, attacks</media:keywords>
</item>

<item>
<title>PraisonAI CVE&#45;2026&#45;44338 Auth Bypass Targeted Within Hours of Disclosure</title>
<link>https://block385.com/praisonai-cve-2026-44338-auth-bypass-targeted-within-hours-of-disclosure</link>
<guid>https://block385.com/praisonai-cve-2026-44338-auth-bypass-targeted-within-hours-of-disclosure</guid>
<description><![CDATA[ Threat actors have been observed attempting to exploit a recently disclosed security vulnerability in PraisonAI, an open-source multi-agent orchestration framework, within four hours of public disclosure.
The vulnerability in question is CVE-2026-44338 (CVSS score: 7.3), a case of missing authentication that exposes sensitive endpoints to anyone, potentially allowing an attacker to invoke the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg2IaSkdVZD_wyJJT-sODoazviDXhw3MGkn5XHYocnTL1YfLJpgJ-1wNaAm0Rk0phyrIv8vS73SNNkPSmlxRkK9ySAQGnn_tCP9JcVKyqee6lxjlYEp0cs2C_R9cDtgCEXwsjWtx1XnafF5r_fAuDDAvg0CRMOgJk8ZMwSjRsw1Js90uR-97t-rh5yU12Oj/s1600/praison.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>PraisonAI, CVE-2026-44338, Auth, Bypass, Targeted, Within, Hours, Disclosure</media:keywords>
</item>

<item>
<title>How AI Hallucinations Are Creating Real Security Risks</title>
<link>https://block385.com/how-ai-hallucinations-are-creating-real-security-risks</link>
<guid>https://block385.com/how-ai-hallucinations-are-creating-real-security-risks</guid>
<description><![CDATA[ AI hallucinations are introducing serious security risks into critical infrastructure decision-making by exploiting human trust through highly confident yet incorrect outputs. When an AI model lacks certainty, it doesn’t have a mechanism to recognize that. Instead, it generates the most probable response based on patterns in its training data, even if that response is inaccurate. These outputs ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi45HPlwBwWVoL1fRSEGy7bjtz4Z05lAO8NWxLqPrzQ93c3j5aaj_CaK5gCrJC6aYP0ePV36n27rw33vJv5mUXf3mtdOEItJjHrSkzckVGAdTU2UMp8s-HAVjNUE7jVDeTH0UikGxNZWeB6J3qVNguP2iO5V5-qUgW3g_IqxZ9cMEZy0tS0iEsl8MnSjB0/s1600/keeper.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>How, Hallucinations, Are, Creating, Real, Security, Risks</media:keywords>
</item>

<item>
<title>AI cyber capability is speeding past earlier projections</title>
<link>https://block385.com/ai-cyber-capability-is-speeding-past-earlier-projections</link>
<guid>https://block385.com/ai-cyber-capability-is-speeding-past-earlier-projections</guid>
<description><![CDATA[ AI cyber capability is improving faster than expected, with newer models surpassing earlier projections, according to the UK government’s AI Security Institute (AISI). AISI measures AI cyber capability using “time horizon benchmarks”, which estimate how long AI systems can complete cybersecurity tasks autonomously compared to human experts. “In February 2026, we estimated that frontier models’ 80%-reliability cyber time horizon had doubled every 4.7 months since reasoning models emerged in late 2024, given a 2.5M token … More →
The post AI cyber capability is speeding past earlier projections appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/17092123/research-ai-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 13:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>cyber, capability, speeding, past, earlier, projections</media:keywords>
</item>

<item>
<title>Microsoft’s WinUI agent plugin trims token use by over 70% during development</title>
<link>https://block385.com/microsofts-winui-agent-plugin-trims-token-use-by-over-70-during-development</link>
<guid>https://block385.com/microsofts-winui-agent-plugin-trims-token-use-by-over-70-during-development</guid>
<description><![CDATA[ Microsoft published a plugin on May 13 that lets GitHub Copilot CLI and Claude Code drive the full WinUI 3 development cycle, from project scaffolding through signed MSIX packaging. The WinUI agent plugin ships one agent, eight skills, and several supporting tools targeting the loop developers run dozens of times a day: scaffold, build, run, test, iterate. Native Windows app development with WinUI 3 pulls together several moving parts that rarely sit cleanly together for … More →
The post Microsoft’s WinUI agent plugin trims token use by over 70% during development appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/14121743/winui-agent-plugin.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 13:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft’s, WinUI, agent, plugin, trims, token, use, over, 70, during, development</media:keywords>
</item>

<item>
<title>Microsoft turns Copilot Studio into an AI agent control center</title>
<link>https://block385.com/microsoft-turns-copilot-studio-into-an-ai-agent-control-center</link>
<guid>https://block385.com/microsoft-turns-copilot-studio-into-an-ai-agent-control-center</guid>
<description><![CDATA[ The Microsoft Copilot Studio April 2026 updates improve visibility and governance for admins and expand workflow capabilities for managing agents. Copilot surfaces agent status in the authoring experience, giving admins insight into each agent’s security and protection posture. Customers can identify issues such as authentication gaps or policy impacts and investigate them at the source. Analytics Viewer role Insights can be shared through the generally available Analytics Viewer role, which grants access to the Analytics … More →
The post Microsoft turns Copilot Studio into an AI agent control center appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/14101308/microsoft_copilot_studio.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 13:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, turns, Copilot, Studio, into, agent, control, center</media:keywords>
</item>

<item>
<title>Windows Zero&#45;Days Expose BitLocker Bypasses And CTFMON Privilege Escalation</title>
<link>https://block385.com/windows-zero-days-expose-bitlocker-bypasses-and-ctfmon-privilege-escalation</link>
<guid>https://block385.com/windows-zero-days-expose-bitlocker-bypasses-and-ctfmon-privilege-escalation</guid>
<description><![CDATA[ An anonymous cybersecurity researcher who disclosed three Microsoft Defender vulnerabilities has returned with two more zero-days involving a BitLocker bypass and a privilege escalation impacting Windows Collaborative Translation Framework (CTFMON).
The security defects have been codenamed YellowKey and GreenPlasma, respectively, by the researcher, who goes by the online aliases Chaotic Eclipse ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXt7ooDl2PwJY4nazAKdW9rmILsmosve2FZaO9usxTk_rkksEEvsLgY-uc_MErXvjvusuWjN7PWRM9KaRXB1OkL75gio7tcqpMsPZxaFNE9XDpYmARH3Dw_gGgddwWXHSt5VUJ-lb56F9bCVzTYghEo7qELWVv8K_W8V1BrWgssgqWkzPJxW6I31i_GyYf/s1600/windowss.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 12:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Windows, Zero-Days, Expose, BitLocker, Bypasses, And, CTFMON, Privilege, Escalation</media:keywords>
</item>

<item>
<title>CERN’s open source KiCad library gives the world 17,000 circuit board components</title>
<link>https://block385.com/cerns-open-source-kicad-library-gives-the-world-17000-circuit-board-components</link>
<guid>https://block385.com/cerns-open-source-kicad-library-gives-the-world-17000-circuit-board-components</guid>
<description><![CDATA[ CERN has released its complete KiCad component library under an open source license, making it available to hardware designers anywhere in the world. The library, maintained by CERN’s Design Office, contains more than 17,000 electronic components in the form of schematic symbols and printed circuit board footprints. Layout of a printed circuit board made using KiCad (Source: CERN) KiCad is a free and open source software suite for printed circuit board design. Because it uses … More →
The post CERN’s open source KiCad library gives the world 17,000 circuit board components appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/14094304/kicad-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 11:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CERN’s, open, source, KiCad, library, gives, the, world, 17, 000, circuit, board, components</media:keywords>
</item>

<item>
<title>18&#45;Year&#45;Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE</title>
<link>https://block385.com/18-year-old-nginx-rewrite-module-flaw-enables-unauthenticated-rce</link>
<guid>https://block385.com/18-year-old-nginx-rewrite-module-flaw-enables-unauthenticated-rce</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed multiple security vulnerabilities impacting NGINX Plus and NGINX Open, including a critical flaw that remained undetected for 18 years.
The vulnerability, discovered by depthfirst, is a heap buffer overflow issue impacting ngx_http_rewrite_module (CVE-2026-42945, CVSS v4 score: 9.2) that could allow an attacker to achieve remote code execution or cause a ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhCvxtNv7UYYMCITB2HLsBgkN83LdRXcw0wmP9gMAfXeNpmJoOJKNIaQb55b-GLDeQHx-dUBkASGDYgstnvYAE5eFuwyzMSxY804fn56OaTsGlESOab9y-kFHJ-iV5iUlWrc5j27WLduUDhW6nRSjkv5tFMKZjDbbmDdk7_NMZ3y7sipHKy7t4XuMQ9YfG/s1600/nn.gif" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 10:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>18-Year-Old, NGINX, Rewrite, Module, Flaw, Enables, Unauthenticated, RCE</media:keywords>
</item>

<item>
<title>New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption</title>
<link>https://block385.com/new-fragnesia-linux-kernel-lpe-grants-root-access-via-page-cache-corruption</link>
<guid>https://block385.com/new-fragnesia-linux-kernel-lpe-grants-root-access-via-page-cache-corruption</guid>
<description><![CDATA[ Details have emerged about a new variant of the recent Dirty Frag Linux local privilege escalation (LPE) vulnerability that allows local attackers to gain root access, making it the third such bug to be identified in the kernel within a span of two weeks.
Codenamed Fragnesia, the security vulnerability is tracked as CVE-2026-46300 (CVSS score: 7.8) and is rooted in the Linux kernel&#039;s XFRM ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZEVPJhl5rAx5o22-s1GQ6E1KKHMlOsazAfObgwK72r5EGxr52OkNRHHQXJdHt39DQop0SAhxE_t9nMKgXxHNgYv1zyB-ZR1IqCIKUK2feTpx1swr4dZzKLpZ5uldjrOAX6qH-wYnUfRWieA2xQWPbAUB1JpXhkBGq4AA0Ft07F7MFqZSHCS9SMR6uXjoC/s1600/linux-2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 10:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Fragnesia, Linux, Kernel, LPE, Grants, Root, Access, via, Page, Cache, Corruption</media:keywords>
</item>

<item>
<title>Closing the AI governance gap in your enterprise</title>
<link>https://block385.com/closing-the-ai-governance-gap-in-your-enterprise</link>
<guid>https://block385.com/closing-the-ai-governance-gap-in-your-enterprise</guid>
<description><![CDATA[ In this Help Net Security video, Casey Bleeker, CEO at SurePath AI, talks about the AI governance gap that exists in almost every organization. Drawing from three years of conversations with IT, business, and security leaders, Casey explains why AI adoption is outpacing governance maturity by a wide margin, creating friction between security teams pushing for responsible use and business leaders worried about falling behind competitors. Casey walks through what a typical audit reveals at … More →
The post Closing the AI governance gap in your enterprise appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/12203032/door-open.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 09:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Closing, the, governance, gap, your, enterprise</media:keywords>
</item>

<item>
<title>Vector embedding security gap exposes enterprise AI pipelines</title>
<link>https://block385.com/vector-embedding-security-gap-exposes-enterprise-ai-pipelines</link>
<guid>https://block385.com/vector-embedding-security-gap-exposes-enterprise-ai-pipelines</guid>
<description><![CDATA[ Enterprise adoption of retrieval-augmented generation has moved sensitive corporate content into a new storage format that existing security tools cannot inspect. Companies deploying internal AI assistants convert documents into high-dimensional numerical vectors and ship them to embedding services and vector databases over ordinary HTTPS connections. Data loss prevention products scan documents and network traffic, and they read none of it. A research framework called VectorSmuggle, released by Jascha Wanger of ThirdKey under the Apache 2.0 … More →
The post Vector embedding security gap exposes enterprise AI pipelines appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/12134206/vectorsmuggle-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 09:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Vector, embedding, security, gap, exposes, enterprise, pipelines</media:keywords>
</item>

<item>
<title>Machine identities outnumber humans 109 to 1</title>
<link>https://block385.com/machine-identities-outnumber-humans-109-to-1</link>
<guid>https://block385.com/machine-identities-outnumber-humans-109-to-1</guid>
<description><![CDATA[ Organizations manage an average of 109 machine identities for every human identity. AI agents account for a growing share of those identities, with companies expecting AI agent growth of 85% over the next 12 months. Machine identities are projected to increase by 77%, and human identities by 56%, based on data from Palo Alto Networks’ 2026 Identity Security Landscape report. Which identity security controls does your organization apply across the AI agent lifecycle? (SOurce: Palo … More →
The post Machine identities outnumber humans 109 to 1 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/09/16094152/identity-person.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 07:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Machine, identities, outnumber, humans, 109</media:keywords>
</item>

<item>
<title>Over 70% of organizations hit by identity breaches</title>
<link>https://block385.com/over-70-of-organizations-hit-by-identity-breaches</link>
<guid>https://block385.com/over-70-of-organizations-hit-by-identity-breaches</guid>
<description><![CDATA[ Attackers rely on stolen credentials, compromised service accounts, and social engineering attacks targeting employees, according to Sophos’ The State of Identity Security 2026 survey. What do you estimate to be the overall cost to your organization to rectify the identity breach? Base: organization could not stop the security breach. n=510. (Source: Sophos) Identity attack trends A survey of 5,000 IT and cybersecurity leaders across 17 countries found that more than 70% of organizations were affected … More →
The post Over 70% of organizations hit by identity breaches appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/28162754/face-glitch-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 07:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Over, 70, organizations, hit, identity, breaches</media:keywords>
</item>

<item>
<title>Checkbox Assessments Aren&amp;apos;t Fit to Measure to Risk</title>
<link>https://block385.com/checkbox-assessments-arent-fit-to-measure-to-risk</link>
<guid>https://block385.com/checkbox-assessments-arent-fit-to-measure-to-risk</guid>
<description><![CDATA[ Security governance needs to be more than an annual compliance exercise. New companies are emerging to address risk-management gaps in current audit tools. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt730562b46d0b78c5/66be4145fa2d5811b851cb52/Risk(1800)_Andriy_Popov_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 01:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Checkbox, Assessments, Arent, Fit, Measure, Risk</media:keywords>
</item>

<item>
<title>Attackers Weaponize RubyGems for Data Dead Drops</title>
<link>https://block385.com/attackers-weaponize-rubygems-for-data-dead-drops</link>
<guid>https://block385.com/attackers-weaponize-rubygems-for-data-dead-drops</guid>
<description><![CDATA[ Threat actors are publishing RubyGems packages that include scrapers targeting public-facing UK government servers, but with no clear objective. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt5c3a7f42da5b1b95/6a04cc6a3840020cbc815a66/ruby_Zerilli_Media_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 01:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Attackers, Weaponize, RubyGems, for, Data, Dead, Drops</media:keywords>
</item>

<item>
<title>Tables Turn on &amp;apos;The Gentlemen&amp;apos; RaaS Gang With Data Leak</title>
<link>https://block385.com/tables-turn-on-the-gentlemen-raas-gang-with-data-leak</link>
<guid>https://block385.com/tables-turn-on-the-gentlemen-raas-gang-with-data-leak</guid>
<description><![CDATA[ An OPSEC failure provides a window into what helped the ransomware group rise: a generous affiliate model, opportunistic TTPs, and an effective organizational structure. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd4988365b90a7362/6a04c7e73c21f66c138b9490/Top_hats-Guy_Corbishley-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 14 May 2026 01:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tables, Turn, The, Gentlemen, RaaS, Gang, With, Data, Leak</media:keywords>
</item>

<item>
<title>Dark Reading Celebrates 20 Years as a Leading Authority on Cybersecurity, Highlighting the People, Events, Ideas, and Technologies Shaping the Modern Risk Landscape</title>
<link>https://block385.com/dark-reading-celebrates-20-years-as-a-leading-authority-on-cybersecurity-highlighting-the-people-events-ideas-and-technologies-shaping-the-modern-risk-landscape</link>
<guid>https://block385.com/dark-reading-celebrates-20-years-as-a-leading-authority-on-cybersecurity-highlighting-the-people-events-ideas-and-technologies-shaping-the-modern-risk-landscape</guid>
<description><![CDATA[ Informa TechTarget&#039;s flagship cybersecurity media brand launches a special content series to mark two decades as a trusted source for cybersecurity professionals. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt850556f866500627/654a5a8e05eb4d040a046894/325351_DR23_Graphics_General_Large_Text_v1.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Dark, Reading, Celebrates, Years, Leading, Authority, Cybersecurity, Highlighting, the, People, Events, Ideas, and, Technologies, Shaping, the, Modern, Risk, Landscape</media:keywords>
</item>

<item>
<title>WhatsApp adds Incognito Chat for private Meta AI conversations</title>
<link>https://block385.com/whatsapp-adds-incognito-chat-for-private-meta-ai-conversations</link>
<guid>https://block385.com/whatsapp-adds-incognito-chat-for-private-meta-ai-conversations</guid>
<description><![CDATA[ The company launched Incognito Chat with Meta AI, a feature that lets users hold AI conversations the platform itself cannot read. The rollout will reach WhatsApp and the standalone Meta AI app over the coming months. How Incognito Chat works Incognito Chat runs on top of Meta’s Private Processing technology, the same infrastructure the company introduced earlier for AI tools in WhatsApp. Messages sent through an Incognito Chat are handled inside a secure environment that … More →
The post WhatsApp adds Incognito Chat for private Meta AI conversations appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/13171417/meta_ai_incognito_chat-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 19:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>WhatsApp, adds, Incognito, Chat, for, private, Meta, conversations</media:keywords>
</item>

<item>
<title>[Webinar] How Modern Attack Paths Cross Code, Pipelines, and Cloud</title>
<link>https://block385.com/webinar-how-modern-attack-paths-cross-code-pipelines-and-cloud</link>
<guid>https://block385.com/webinar-how-modern-attack-paths-cross-code-pipelines-and-cloud</guid>
<description><![CDATA[ TL;DR: Stop chasing thousands of &quot;toast&quot; alerts. Join experts from Wiz to learn how hackers connect tiny flaws to build a &quot;Lethal Chain&quot; to your data—and how to break it. Register for the Strategic Briefing Here.
Most security tools work like a smoke alarm that goes off every time you burn a piece of toast. You get so many alerts that you eventually start to ignore them.
The real danger? While ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-X1ZWS1wjhotRXh44H3uH6bxJmz3fwKA9tFIuYxCVV_b_BhzNKscxBa_St0ybBNSIpHYTlgBf0YvsuY1B2FUJebmGwtpkgeDh7DutT4ERpurg_iRTfDNbyWWzFOt5Z8PLGDu-kywwNTPdNVK_UDcAC8ZzdFCry5xDvx8c8l9QtNJKk6J4ZQVRIpvAfzwf/s1600/wiz.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 18:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Webinar, How, Modern, Attack, Paths, Cross, Code, Pipelines, and, Cloud</media:keywords>
</item>

<item>
<title>Tuskira’s Kairo exposes hidden AI&#45;driven breach paths</title>
<link>https://block385.com/tuskiras-kairo-exposes-hidden-ai-driven-breach-paths</link>
<guid>https://block385.com/tuskiras-kairo-exposes-hidden-ai-driven-breach-paths</guid>
<description><![CDATA[ Tuskira has announced the launch of Kairo, a breach modeling capability that detects deep, hidden breach paths by leveraging its security data mesh and digital twin technology. Kairo helps security teams improve breach resilience by modeling how attackers can leverage new AI models to laterally move across an environment, identifying deep hidden kill chains across cloud, IT &amp; OT infrastructure. Kairo also validates detected breach paths against existing security controls if attackers can also bypass … More →
The post Tuskira’s Kairo exposes hidden AI-driven breach paths appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 17:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tuskira’s, Kairo, exposes, hidden, AI-driven, breach, paths</media:keywords>
</item>

<item>
<title>LatAm Vibe Hackers Generate Custom Hacking Tools on the Fly</title>
<link>https://block385.com/latam-vibe-hackers-generate-custom-hacking-tools-on-the-fly</link>
<guid>https://block385.com/latam-vibe-hackers-generate-custom-hacking-tools-on-the-fly</guid>
<description><![CDATA[ In the latest evolution of automated cyberattacks, two threat campaigns heavily leveraged AI agents to support attacks against entities in Mexico and Brazil. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt21f9c2318a5ab687/6a038ac9398f1c61e4de8097/evil_robot_Anna_Vaczi_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 17:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>LatAm, Vibe, Hackers, Generate, Custom, Hacking, Tools, the, Fly</media:keywords>
</item>

<item>
<title>Signal responds to phishing attacks with new in&#45;app security warnings</title>
<link>https://block385.com/signal-responds-to-phishing-attacks-with-new-in-app-security-warnings</link>
<guid>https://block385.com/signal-responds-to-phishing-attacks-with-new-in-app-security-warnings</guid>
<description><![CDATA[ Signal is adding new protections for users following recent phishing and social engineering attacks. In March, the FBI and CISA issued a warning stating that Signal had become a primary target of Russian intelligence-linked hackers. Dutch and German security authorities were among the first to identify phishing campaigns targeting Signal users. The scheme centered on Signal’s “linked devices” feature. Attackers contacted targets while posing as trusted entities, including support teams or known contacts. Victims were … More →
The post Signal responds to phishing attacks with new in-app security warnings appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/13140947/signal-app-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 17:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Signal, responds, phishing, attacks, with, new, in-app, security, warnings</media:keywords>
</item>

<item>
<title>Microsoft&amp;apos;s MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday</title>
<link>https://block385.com/microsofts-mdash-ai-system-finds-16-windows-flaws-fixed-in-patch-tuesday</link>
<guid>https://block385.com/microsofts-mdash-ai-system-finds-16-windows-flaws-fixed-in-patch-tuesday</guid>
<description><![CDATA[ Microsoft has unveiled a new multi-model artificial intelligence (AI)-driven system called MDASH to facilitate vulnerability discovery and remediation at scale, adding that it&#039;s being tested by some customers as part of a limited private preview.
MDASH, short for multi-model agentic scanning harness, is designed as a model-agnostic system that uses bespoke AI agents for different vulnerability ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1Iq16GS3jdGiIU24GHBkwg6unk05ctdgYwXO5df8zRu1qko95_XhszCjq6jlEIRozLsrtZHgi5GqDZnS1Sw_KDzUzsagwP0If3VswmYHsnuYwVseU2lapxQiPpItTdAiv-CCdTFR87ZVOu65buyvmvzmdWuJPKHuPA4DSo58HQIMAV__2ymsmRe2g3UVe/s1600/windows-ai.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsofts, MDASH, System, Finds, Windows, Flaws, Fixed, Patch, Tuesday</media:keywords>
</item>

<item>
<title>Azerbaijani Energy Firm Hit by Repeated Microsoft Exchange Exploitation</title>
<link>https://block385.com/azerbaijani-energy-firm-hit-by-repeated-microsoft-exchange-exploitation</link>
<guid>https://block385.com/azerbaijani-energy-firm-hit-by-repeated-microsoft-exchange-exploitation</guid>
<description><![CDATA[ A threat actor with affiliations to China has been linked to a &quot;multi-wave intrusion&quot; targeting an unnamed Azerbaijani oil and gas company between late December 2025 and late February 2026, marking an expansion of its targeting.
The activity has been attributed by Bitdefender with moderate-to-high confidence to a hacking group known as FamousSparrow (aka UAT-9244), which shares some level of ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOfGXVOYqF2EcrcnYIDCnTYdmWpV-uaZ5nV0_0ukZ8uCk19wFFOax_VvgwO8LtlIkVo8pvcSSBs8Afc66yo2PbiMDjq4UDqnytAqP-Nq8CqTOfEtqwuWRmjbUpRYzqaAXFnRiXozR34fXAPE8O6Gcix6f08Sped3oVUXcjIOTE04N8IInA0qVeG0Sc6LzB/s1600/energy-cyberattack.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Azerbaijani, Energy, Firm, Hit, Repeated, Microsoft, Exchange, Exploitation</media:keywords>
</item>

<item>
<title>KDE gets over €1 million investment to strengthen security and core infrastructure</title>
<link>https://block385.com/kde-gets-over-1-million-investment-to-strengthen-security-and-core-infrastructure</link>
<guid>https://block385.com/kde-gets-over-1-million-investment-to-strengthen-security-and-core-infrastructure</guid>
<description><![CDATA[ European governments and public institutions have been shifting away from proprietary software for years, and the financial infrastructure supporting open-source alternatives is growing to match. Germany’s Sovereign Tech Fund announced today that it is investing more than €1 million in KDE, the open-source project behind the Plasma desktop environment and a broad range of Linux software. The investment will go toward strengthening KDE’s testing infrastructure, security architecture, and the frameworks underpinning its communication services. KDE … More →
The post KDE gets over €1 million investment to strengthen security and core infrastructure appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/13125115/kde-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 15:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>KDE, gets, over, €1, million, investment, strengthen, security, and, core, infrastructure</media:keywords>
</item>

<item>
<title>AI Agents Generate Custom Hacking Tools on the Fly</title>
<link>https://block385.com/ai-agents-generate-custom-hacking-tools-on-the-fly</link>
<guid>https://block385.com/ai-agents-generate-custom-hacking-tools-on-the-fly</guid>
<description><![CDATA[ Two threat campaigns heavily leveraged AI agents to support attacks against entities in Mexico and Brazil. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt21f9c2318a5ab687/6a038ac9398f1c61e4de8097/evil_robot_Anna_Vaczi_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 15:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Agents, Generate, Custom, Hacking, Tools, the, Fly</media:keywords>
</item>

<item>
<title>It&amp;apos;s Patch Tuesday for Microsoft &amp;amp;amp; Not a Zero&#45;Day In Sight</title>
<link>https://block385.com/its-patch-tuesday-for-microsoft-not-a-zero-day-in-sight</link>
<guid>https://block385.com/its-patch-tuesday-for-microsoft-not-a-zero-day-in-sight</guid>
<description><![CDATA[ It&#039;s the first time in two years with no zero-days. But with 137 flaws to patch, including nine critical ones, admins still have plenty of work to do. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blta3704ee375f0b629/6a038cf3ee64ff5eb73bf289/swbug_Andrii_Yalanskyi_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 15:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Its, Patch, Tuesday, for, Microsoft, &amp;amp, Not, Zero-Day, Sight</media:keywords>
</item>

<item>
<title>Apricorn hardens ASK3 encrypted USB drive for extreme conditions</title>
<link>https://block385.com/apricorn-hardens-ask3-encrypted-usb-drive-for-extreme-conditions</link>
<guid>https://block385.com/apricorn-hardens-ask3-encrypted-usb-drive-for-extreme-conditions</guid>
<description><![CDATA[ Apricorn has announced enhancements to its Aegis Secure Key 3.0 (ASK3), delivering faster performance and new environmental protection capabilities designed to secure the device and its data in the most demanding physical circumstances. The ASK3 was updated to meet and exceed the latest NIST Cryptographic Module Validation Program (CMVP) for FIPS 140-3 Level 3 validation, for which it has formally been submitted. This positions the ASK3 for use by government, defence contractors, and organisations across … More →
The post Apricorn hardens ASK3 encrypted USB drive for extreme conditions appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 15:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apricorn, hardens, ASK3, encrypted, USB, drive, for, extreme, conditions</media:keywords>
</item>

<item>
<title>China&amp;apos;s &amp;apos;FamousSparrow&amp;apos; APT Nests in South Caucasus Energy Firm</title>
<link>https://block385.com/chinas-famoussparrow-apt-nests-in-south-caucasus-energy-firm</link>
<guid>https://block385.com/chinas-famoussparrow-apt-nests-in-south-caucasus-energy-firm</guid>
<description><![CDATA[ The cyberthreat group targets an Azerbaijani oil and gas firm with repeated attacks, as the China-linked actors extend targeting beyond hospitality, telecom, and government sectors. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt69a3ca2781c97543/6a039734559f883c8de4d9ec/pair-of-java-sparrows-Alen_Thien-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 15:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Chinas, FamousSparrow, APT, Nests, South, Caucasus, Energy, Firm</media:keywords>
</item>

<item>
<title>[Webinar] Why Your AppSec Tools Miss the &amp;quot;Lethal Path&amp;quot; (and How to Fix It)</title>
<link>https://block385.com/webinar-why-your-appsec-tools-miss-the-lethal-path-and-how-to-fix-it</link>
<guid>https://block385.com/webinar-why-your-appsec-tools-miss-the-lethal-path-and-how-to-fix-it</guid>
<description><![CDATA[ TL;DR: Stop chasing thousands of &quot;toast&quot; alerts. Join experts from Wiz and Okta/GitLab to learn how hackers connect tiny flaws to build a &quot;Lethal Chain&quot; to your data—and how to break it. Register for the Strategic Briefing Here.
Most security tools work like a smoke alarm that goes off every time you burn a piece of toast. You get so many alerts that you eventually start to ignore them.
The real ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-X1ZWS1wjhotRXh44H3uH6bxJmz3fwKA9tFIuYxCVV_b_BhzNKscxBa_St0ybBNSIpHYTlgBf0YvsuY1B2FUJebmGwtpkgeDh7DutT4ERpurg_iRTfDNbyWWzFOt5Z8PLGDu-kywwNTPdNVK_UDcAC8ZzdFCry5xDvx8c8l9QtNJKk6J4ZQVRIpvAfzwf/s1600/wiz.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 14:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Webinar, Why, Your, AppSec, Tools, Miss, the, Lethal, Path, and, How, Fix, It</media:keywords>
</item>

<item>
<title>Most Remediation Programs Never Confirm the Fix Actually Worked</title>
<link>https://block385.com/most-remediation-programs-never-confirm-the-fix-actually-worked</link>
<guid>https://block385.com/most-remediation-programs-never-confirm-the-fix-actually-worked</guid>
<description><![CDATA[ Security teams have never had better visibility into their environments and never been worse at confirming what they fix stays fixed.
Mandiant&#039;s M-Trends 2026 report puts the mean time to exploit at an estimated negative seven days. The Verizon 2025 DBIR puts median time to remediate edge device vulnerabilities at 32 days. These numbers have understandably driven the industry toward a clear ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg70Fxtk3MEmUdZjXl_ocBSlT80rWfXtIj2kxPvypzCSlEK4cqkm8lo16NXHjvyCw9niiPk2gKSPhgTjSFTZpetxg2As7QL0AyWWHoTuvtcp1Ok-ALMfcUwaUMAyE8asDu-KjVDoUP4VLCOSDPWHru7V-ix6Xs-VSHvHDJ8KRn6NLq_EJJBm0B4xwa9vbLp/s1600/pentera.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 14:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Most, Remediation, Programs, Never, Confirm, the, Fix, Actually, Worked</media:keywords>
</item>

<item>
<title>Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws</title>
<link>https://block385.com/microsoft-patches-138-vulnerabilities-including-dns-and-netlogon-rce-flaws</link>
<guid>https://block385.com/microsoft-patches-138-vulnerabilities-including-dns-and-netlogon-rce-flaws</guid>
<description><![CDATA[ Microsoft on Tuesday released patches for 138 security vulnerabilities spanning its product portfolio, although none of them have been listed as publicly known or under active attack.
Of the 138 flaws, 30 are rated Critical, 104 are rated Important, three are rated Moderate, and one is rated Low in severity. As many as 61 vulnerabilities are classified as privilege escalation bugs, followed by ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjk3m3CoTiKH2QVXSFAOVKKnTl-Ybt1FDE4M7BGK_ujskSYNQ8pOlcvZfyNv8CW2EJIVdMQaORcCE0H-_ufTvD6hR-LOOZ64GZPS_9bH7YrE4i0r4LrGCn7vXmG0GjpFk8aNlRR_4_GjrM-jhXBS1NzIbYiRydcmiNSXIV2eUczvgjGmp34_gNz3M5kt-Jf/s1600/windows-patch-update.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 14:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Patches, 138, Vulnerabilities, Including, DNS, and, Netlogon, RCE, Flaws</media:keywords>
</item>

<item>
<title>Microsoft’s agentic security system found four critical Windows RCE flaws</title>
<link>https://block385.com/microsofts-agentic-security-system-found-four-critical-windows-rce-flaws</link>
<guid>https://block385.com/microsofts-agentic-security-system-found-four-critical-windows-rce-flaws</guid>
<description><![CDATA[ Microsoft responded to growing competition in AI security by announcing that its new agentic security system helped researchers discover 16 new vulnerabilities in the Windows networking and authentication stack, including four critical remote code execution (RCE) flaws. MDASH architecture diagram (Source: Microsoft) Two of the four flaws — CVE-2026-40361 and CVE-2026-40364 — were deemed by Microsoft to be more likely to be exploited. The multi-model agentic scanning harness, codenamed MDASH, was built by Microsoft’s Autonomous … More →
The post Microsoft’s agentic security system found four critical Windows RCE flaws appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/08/05120625/microsoft-ai-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 13:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft’s, agentic, security, system, found, four, critical, Windows, RCE, flaws</media:keywords>
</item>

<item>
<title>GemStuffer Abuses 150+ RubyGems to Exfiltrate Scraped U.K. Council Portal Data</title>
<link>https://block385.com/gemstuffer-abuses-150-rubygems-to-exfiltrate-scraped-uk-council-portal-data</link>
<guid>https://block385.com/gemstuffer-abuses-150-rubygems-to-exfiltrate-scraped-uk-council-portal-data</guid>
<description><![CDATA[ Cybersecurity researchers are calling attention to a new campaign dubbed GemStuffer that has targeted the RubyGems repository with more than 150 gems that use the registry as a data exfiltration channel rather than for malware distribution.
&quot;The packages do not appear designed for mass developer compromise,&quot; Socket said. &quot;Many have little or no download activity, and the payloads are repetitive, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZpbB_p88zZf6q_DhwCbgnYn2okFYqa7pwIPmknojvkOC3heteNMp3C6bzD_6WKChB4yVK0wLyoJ_-DebN0c229j-twjPyMAC-qkfGs1tjlaEoNg30fpEDh9DIByfz_h4nKhalTC_Su-FP0AYxywL_x85ILq1t-QFPtuMa_-KbLKlfsX15kvGpPCs1OZpw/s1600/rubygemss.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 12:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GemStuffer, Abuses, 150, RubyGems, Exfiltrate, Scraped, U.K., Council, Portal, Data</media:keywords>
</item>

<item>
<title>Versa CSPM brings continuous visibility to cloud risk and compliance exposure</title>
<link>https://block385.com/versa-cspm-brings-continuous-visibility-to-cloud-risk-and-compliance-exposure</link>
<guid>https://block385.com/versa-cspm-brings-continuous-visibility-to-cloud-risk-and-compliance-exposure</guid>
<description><![CDATA[ Versa has announced Versa Cloud Security Posture Management (CSPM), extending the VersaONE Universal SASE Platform to provide continuous visibility, prioritization, and remediation of cloud risk across environments. With CSPM, Versa combines secure access protection and cloud posture risk on a single platform, delivering the visibility security teams need to quantify and reduce enterprise cyber exposure. For years, security has evolved in silos. Access is protected, but cloud misconfiguration risk remains fragmented and hard to see. … More →
The post Versa CSPM brings continuous visibility to cloud risk and compliance exposure appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 11:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Versa, CSPM, brings, continuous, visibility, cloud, risk, and, compliance, exposure</media:keywords>
</item>

<item>
<title>Android Adds Intrusion Logging for Sophisticated Spyware Forensics</title>
<link>https://block385.com/android-adds-intrusion-logging-for-sophisticated-spyware-forensics</link>
<guid>https://block385.com/android-adds-intrusion-logging-for-sophisticated-spyware-forensics</guid>
<description><![CDATA[ Google on Tuesday unveiled a new opt-in Android feature called Intrusion Logging for storing forensic logs to better analyze sophisticated spyware attacks.
Intrusion Logging, available as part of Advanced Protection Mode, enables &quot;persistent and privacy-preserving forensics logging to allow for investigation of devices in the event of a suspected compromise,&quot; the company said.
The feature, it ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBNoTD0wrxHsoNUfZVLT2ImOUNC-2Md_wih6gTim-zbqkCzgGfXbtvlDgDMWeczo9RzINqu7qqk_3XK0KHSdbpLMPbR9xg_pLpjtoxugUt3B5-G9pL9wBCMI80Rx-Aw9eNxH-XXE2XpQHDtqaGDeXe3P4mGDvPgmDiqom8B2Xdfz7irCpOZVvhP9jsqudo/s1600/adnroid-Intrusion-Logging.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Android, Adds, Intrusion, Logging, for, Sophisticated, Spyware, Forensics</media:keywords>
</item>

<item>
<title>The hidden risk of non&#45;human identities in AI adoption</title>
<link>https://block385.com/the-hidden-risk-of-non-human-identities-in-ai-adoption</link>
<guid>https://block385.com/the-hidden-risk-of-non-human-identities-in-ai-adoption</guid>
<description><![CDATA[ An employee with persistent, unsupervised admin access across critical systems, with no audit trail, no clear owner, and no regular access reviews, would raise immediate concern in most organizations. Yet non-human identities and AI agents are often granted that same kind of persistent, broadly privileged access. As AI adoption grows, that gap is becoming harder to ignore. NHIs today encompass far more than traditional service accounts and API keys. They also often include AI agents … More →
The post The hidden risk of non-human identities in AI adoption appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/11132505/delinea_ai_identities.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 09:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, hidden, risk, non-human, identities, adoption</media:keywords>
</item>

<item>
<title>Sandyaa: Open&#45;source autonomous security bug hunter</title>
<link>https://block385.com/sandyaa-open-source-autonomous-security-bug-hunter</link>
<guid>https://block385.com/sandyaa-open-source-autonomous-security-bug-hunter</guid>
<description><![CDATA[ Source code auditing has traditionally relied on static analyzers that flag long lists of potential issues, leaving engineers to sort bugs from noise. A new open-source project from offensive-security firm SecureLayer7 takes a different route, using LLMs to read a codebase, trace how data moves through it, and produce working exploit code for the vulnerabilities it confirms. Their open-source tool, called Sandyaa, was released under an MIT license. How the auditor operates Sandyaa accepts either … More →
The post Sandyaa: Open-source autonomous security bug hunter appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/10111940/sandyaa-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 09:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Sandyaa:, Open-source, autonomous, security, bug, hunter</media:keywords>
</item>

<item>
<title>NetSPI AI&#45;powered Continuous Pentesting identifies high&#45;impact vulnerabilities</title>
<link>https://block385.com/netspi-ai-powered-continuous-pentesting-identifies-high-impact-vulnerabilities</link>
<guid>https://block385.com/netspi-ai-powered-continuous-pentesting-identifies-high-impact-vulnerabilities</guid>
<description><![CDATA[ NetSPI launched AI-powered Continuous Pentesting offerings, designed to help organizations continuously identify, validate and reduce risk across dynamic external and cloud environments. Organizations are managing an expanding number of potential entry points as new internet-facing resources, including cloud assets, applications, APIs, and AI-centric assets, are introduced. Each deployment can create new risk, making it harder for security teams to maintain a view of exposure without continuous, validated insight. NetSPI’s Continuous Pentesting offerings include Continuous External … More →
The post NetSPI AI-powered Continuous Pentesting identifies high-impact vulnerabilities appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 09:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NetSPI, AI-powered, Continuous, Pentesting, identifies, high-impact, vulnerabilities</media:keywords>
</item>

<item>
<title>Android pushes new scam, theft, and AI protections in 2026 update wave</title>
<link>https://block385.com/android-pushes-new-scam-theft-and-ai-protections-in-2026-update-wave</link>
<guid>https://block385.com/android-pushes-new-scam-theft-and-ai-protections-in-2026-update-wave</guid>
<description><![CDATA[ Phone scammers spoofing bank caller IDs have driven an estimated $980 million in annual losses worldwide, according to Europol. Android’s 2026 security roadmap takes direct aim at that pattern with a verified call system built in partnership with banks, alongside a wider set of protections covering app behavior, device theft, location data, and on-device AI processing. Verified financial calls A new feature called verified financial calls will check incoming calls against the official app of … More →
The post Android pushes new scam, theft, and AI protections in 2026 update wave appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/12204108/android-security-privacy.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 07:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Android, pushes, new, scam, theft, and, protections, 2026, update, wave</media:keywords>
</item>

<item>
<title>Researchers open&#45;source a Wi&#45;Fi cyber range for security training</title>
<link>https://block385.com/researchers-open-source-a-wi-fi-cyber-range-for-security-training</link>
<guid>https://block385.com/researchers-open-source-a-wi-fi-cyber-range-for-security-training</guid>
<description><![CDATA[ Wireless security training programs lean heavily on generic network labs, with Wi-Fi appearing as a checkbox alongside Bluetooth, Zigbee, and cellular. Hands-on environments dedicated to IEEE 802.11 are uncommon, even as Wi-Fi remains the default on-ramp to corporate networks and a recurring entry point for attackers. A new paper from researchers at the Norwegian University of Science and Technology and the University of the Aegean takes aim at that gap with a cyber range built … More →
The post Researchers open-source a Wi-Fi cyber range for security training appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/11170922/wireless-connection.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 07:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researchers, open-source, Wi-Fi, cyber, range, for, security, training</media:keywords>
</item>

<item>
<title>Fedora Hummingbird brings the container security model to a Linux host OS</title>
<link>https://block385.com/fedora-hummingbird-brings-the-container-security-model-to-a-linux-host-os</link>
<guid>https://block385.com/fedora-hummingbird-brings-the-container-security-model-to-a-linux-host-os</guid>
<description><![CDATA[ Container image security pipelines have spent the past several years pushing toward minimal footprints, hermetic builds, and continuous CVE remediation. The Fedora Project is now applying that same approach to the host operating system. At Red Hat Summit 2026, Fedora announced Fedora Hummingbird, a container-based rolling Linux distribution delivered as an OCI image. “The Linux market has split: IT operations teams need the decades-long stability of Red Hat Enterprise Linux, while builders, both human and … More →
The post Fedora Hummingbird brings the container security model to a Linux host OS appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/12202003/fedora_hummingbird-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 01:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fedora, Hummingbird, brings, the, container, security, model, Linux, host</media:keywords>
</item>

<item>
<title>It&amp;apos;s Patch Tuesday for Microsoft and Not a Zero&#45;Day In Sight</title>
<link>https://block385.com/its-patch-tuesday-for-microsoft-and-not-a-zero-day-in-sight</link>
<guid>https://block385.com/its-patch-tuesday-for-microsoft-and-not-a-zero-day-in-sight</guid>
<description><![CDATA[ It&#039;s the first time in two years with no zero-days. But with 137 flaws to patch, including nine critical ones, admins still have plenty of work to do. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blta3704ee375f0b629/6a038cf3ee64ff5eb73bf289/swbug_Andrii_Yalanskyi_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 13 May 2026 01:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Its, Patch, Tuesday, for, Microsoft, and, Not, Zero-Day, Sight</media:keywords>
</item>

<item>
<title>Microsoft May 2026 Patch Tuesday: Many fixes, but no zero&#45;days</title>
<link>https://block385.com/microsoft-may-2026-patch-tuesday-many-fixes-but-no-zero-days</link>
<guid>https://block385.com/microsoft-may-2026-patch-tuesday-many-fixes-but-no-zero-days</guid>
<description><![CDATA[ Microsoft has marked May 2026 Patch Tuesday by releasing fixes for 120+ CVE-numbered vulnerabilities, none of which (for a change) are actively exploited or have been publicly disclosed. Still, some deserve more consideration and should be addressed sooner than others. Patches to prioritize For Satnam Narang, senior staff research engineer at Tenable, the four critical remote code execution bugs in Microsoft Word stand out in this release, and especially the two (CVE-2026-40361, CVE-2026-40364) that have … More →
The post Microsoft May 2026 Patch Tuesday: Many fixes, but no zero-days appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/12193553/patch-tuesday-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 23:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, May, 2026, Patch, Tuesday:, Many, fixes, but, zero-days</media:keywords>
</item>

<item>
<title>New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution</title>
<link>https://block385.com/new-exim-bdat-vulnerability-exposes-gnutls-builds-to-potential-code-execution</link>
<guid>https://block385.com/new-exim-bdat-vulnerability-exposes-gnutls-builds-to-potential-code-execution</guid>
<description><![CDATA[ Exim has released security updates to address a severe security issue affecting certain configurations that could enable memory corruption and potential code execution.
Exim is an open-source Mail Transfer Agent (MTA) designed for Unix-like systems to receive, route, and deliver email.
The vulnerability, tracked as CVE-2026-45185, aka Dead.Letter, has been described as a use-after-free ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgrSn3emm_NbwXDi3elR0wo5ErHhg-gPT4-u4zk7MHZg4u0ruMmj2_KGgPF8fz06Riv6Gu5NXMN3eBP8H5bVf6dmvOz-lvb-qrvhLlssLUzl97ZVmIWoIOmMPOGrupv864dt0d4V_dxgaaxYYNuy2z9rbZMWIOcjlwZaiifq4-ktRqlEBCJ6a_m3MFiwq65/s1600/exim.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Exim, BDAT, Vulnerability, Exposes, GnuTLS, Builds, Potential, Code, Execution</media:keywords>
</item>

<item>
<title>RubyGems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded</title>
<link>https://block385.com/rubygems-suspends-new-signups-after-hundreds-of-malicious-packages-are-uploaded</link>
<guid>https://block385.com/rubygems-suspends-new-signups-after-hundreds-of-malicious-packages-are-uploaded</guid>
<description><![CDATA[ RubyGems, the standard package manager for the Ruby programming language, has temporarily paused account sign ups following what has been described as a &quot;major malicious attack.&quot;
&quot;We&#039;re dealing with a major malicious attack on Ruby Gems right now,&quot; Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, said in a post on X. &quot;Signups are paused for the time being. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggIbYm86Vn45Nd86Hd5IEqHufRIS5Ud3spGUy5JWHy-My-NBVocyj-aR7E3gBKibPnrWd5DRYnDfmbaHUMuaYcNn_paUIDN11VLySLNUsXwFwVIALsNo419985zWvtepK7NVp9J4W3d7uHGWkQFgqI6zY_9Y5LWe5hsTLk-c9ZMKQ4TDlUMcMh8-_vhdIH/s1600/rubygems.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>RubyGems, Suspends, New, Signups, After, Hundreds, Malicious, Packages, Are, Uploaded</media:keywords>
</item>

<item>
<title>Stealthy hackers exploit cPanel flaw in active backdoor campaign (CVE&#45;2026&#45;41940)</title>
<link>https://block385.com/stealthy-hackers-exploit-cpanel-flaw-in-active-backdoor-campaign-cve-2026-41940</link>
<guid>https://block385.com/stealthy-hackers-exploit-cpanel-flaw-in-active-backdoor-campaign-cve-2026-41940</guid>
<description><![CDATA[ Security researchers at XLab have outlined an active attack campaign targeting CVE-2026-41940, the recently disclosed vulnerability in cPanel &amp; WHM, and have linked it to a stealthy hacking group that has been operating largely undetected for years. The vulnerability allows an attacker to log into a cPanel server without a username or password, effectively handing them administrator control over the cPanel host system, its configurations and databases, and the websites it manages. The attack campaign … More →
The post Stealthy hackers exploit cPanel flaw in active backdoor campaign (CVE-2026-41940) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/30141939/cpanel-1500-1.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 19:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Stealthy, hackers, exploit, cPanel, flaw, active, backdoor, campaign, CVE-2026-41940</media:keywords>
</item>

<item>
<title>ThreatDown ITDR prevents credential&#45;based attacks</title>
<link>https://block385.com/threatdown-itdr-prevents-credential-based-attacks</link>
<guid>https://block385.com/threatdown-itdr-prevents-credential-based-attacks</guid>
<description><![CDATA[ ThreatDown, the former corporate business unit of Malwarebytes, launched ThreatDown Identity Threat Detection and Response (ITDR). ITDR is a new product that helps security teams monitor identities to detect suspicious activity, misconfigurations, and active attacks targeting user accounts and privileges. With native integrations for Microsoft Entra ID, Okta, and Active Directory, security teams gain unified visibility across hybrid identity environments without deploying additional agents. Natively integrated with the ThreatDown EDR and MDR platform, ITDR delivers … More →
The post ThreatDown ITDR prevents credential-based attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 19:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ThreatDown, ITDR, prevents, credential-based, attacks</media:keywords>
</item>

<item>
<title>Exaforce raises $125 million to respond to AI&#45;powered attacks</title>
<link>https://block385.com/exaforce-raises-125-million-to-respond-to-ai-powered-attacks</link>
<guid>https://block385.com/exaforce-raises-125-million-to-respond-to-ai-powered-attacks</guid>
<description><![CDATA[ Exaforce announced a $125 million Series B financing round, one of the largest ever in the emerging AI SOC space. The round includes participation from HarbourVest, Peak XV, Mayfield, Khosla Ventures, Seligman Ventures and AICONIC. The new capital will help Exaforce scale its AI-native security operations platform, deepen its real-time reasoning capabilities, and expand globally. Coming just one year after its $75 million Series A, the round brings Exaforce’s total funding to $200 million. AI … More →
The post Exaforce raises $125 million to respond to AI-powered attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 19:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Exaforce, raises, 125, million, respond, AI-powered, attacks</media:keywords>
</item>

<item>
<title>SAP unveils Autonomous Enterprise for AI&#45;driven business operations</title>
<link>https://block385.com/sap-unveils-autonomous-enterprise-for-ai-driven-business-operations</link>
<guid>https://block385.com/sap-unveils-autonomous-enterprise-for-ai-driven-business-operations</guid>
<description><![CDATA[ SAP introduced the Autonomous Enterprise to help enhance the world’s most critical business workflows, so that humans and AI work together to meet the accelerating demands of global business profitably, strategically and safely. “For the mission-critical processes of our customers, ‘almost right’ just isn’t good enough,” said Christian Klein, CEO of SAP SE. “By uniting SAP Business AI Platform with SAP Autonomous Suite, we anchor AI agents in the business processes, data and governance so … More →
The post SAP unveils Autonomous Enterprise for AI-driven business operations appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 19:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SAP, unveils, Autonomous, Enterprise, for, AI-driven, business, operations</media:keywords>
</item>

<item>
<title>Hugging Face Packages Weaponized With a Single File Tweak</title>
<link>https://block385.com/hugging-face-packages-weaponized-with-a-single-file-tweak</link>
<guid>https://block385.com/hugging-face-packages-weaponized-with-a-single-file-tweak</guid>
<description><![CDATA[ A tokenizer library file present in Hugging Face AI models can be manipulated to hijack the model&#039;s outputs and exfiltrate data. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte4a392e468c2fede/6a02399dd02601ddfa8e5443/Hugging_Face_Sidney_Van_den_Boogaard_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 19:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hugging, Face, Packages, Weaponized, With, Single, File, Tweak</media:keywords>
</item>

<item>
<title>Worm Redux: Fresh Mini Shai&#45;Hulud Infections Bite Supply Chain</title>
<link>https://block385.com/worm-redux-fresh-mini-shai-hulud-infections-bite-supply-chain</link>
<guid>https://block385.com/worm-redux-fresh-mini-shai-hulud-infections-bite-supply-chain</guid>
<description><![CDATA[ Hundreds of npm packages infected by the self-propagating, credential-stealing worm from TeamPCP are related to the open source TanStack ecosystem. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt98af205e9fd3397b/6a030d8e8affd2e99d18dd19/sandworms_FlixPix_Alamy.png" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 19:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Worm, Redux:, Fresh, Mini, Shai-Hulud, Infections, Bite, Supply, Chain</media:keywords>
</item>

<item>
<title>General Motors to pay $12.75 million over driver data sales</title>
<link>https://block385.com/general-motors-to-pay-1275-million-over-driver-data-sales</link>
<guid>https://block385.com/general-motors-to-pay-1275-million-over-driver-data-sales</guid>
<description><![CDATA[ General Motors has agreed to a $12.75 million settlement with California over allegations that it unlawfully sold drivers’ location and behavioral data to brokers, marking the largest penalty in the history of the state’s Consumer Privacy Act. Prosecutors say GM made approximately $20 million nationwide from the sales. “General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so. This trove … More →
The post General Motors to pay $12.75 million over driver data sales appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/03125326/car-tire-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 17:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>General, Motors, pay, 12.75, million, over, driver, data, sales</media:keywords>
</item>

<item>
<title>Download: The IT and security field guide to AI adoption</title>
<link>https://block385.com/download-the-it-and-security-field-guide-to-ai-adoption</link>
<guid>https://block385.com/download-the-it-and-security-field-guide-to-ai-adoption</guid>
<description><![CDATA[ Security and IT teams are under pressure to adopt AI, but many are seeing the opposite of what was promised. Tools that demo well don’t hold up in real workflows. Complexity increases. Trust breaks down. And instead of reducing workload, AI can introduce new risks and oversight burdens. This guide breaks down why AI adoption fails in practice and gives teams a clearer path forward, from evaluation to implementation, with humans in the loop. What … More →
The post Download: The IT and security field guide to AI adoption appeared first on Help Net Security. ]]></description>
<enclosure url="https://www.datocms-assets.com/55802/1775576886-itandsecurityfieldguide-dato-img.png" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 17:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Download:, The, and, security, field, guide, adoption</media:keywords>
</item>

<item>
<title>Veeam Intelligent ResOps unifies data context and recovery</title>
<link>https://block385.com/veeam-intelligent-resops-unifies-data-context-and-recovery</link>
<guid>https://block385.com/veeam-intelligent-resops-unifies-data-context-and-recovery</guid>
<description><![CDATA[ Veeam Software announced Veeam Intelligent ResOps, a new solution that unifies data context and recovery operations. As agentic AI accelerates change at machine speed, Intelligent ResOps gives teams the insight they need into their data to quickly understand impact and recover precisely – without broad rollbacks when something happens. When insights are disconnected from recovery, response slows and risk rises. Intelligent ResOps is the first resilience offering on the new Veeam DataAI Command Platform and … More →
The post Veeam Intelligent ResOps unifies data context and recovery appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 17:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Veeam, Intelligent, ResOps, unifies, data, context, and, recovery</media:keywords>
</item>

<item>
<title>Instructure took a risky approach to recover stolen Canvas data</title>
<link>https://block385.com/instructure-took-a-risky-approach-to-recover-stolen-canvas-data</link>
<guid>https://block385.com/instructure-took-a-risky-approach-to-recover-stolen-canvas-data</guid>
<description><![CDATA[ Instructure, the company behind the online learning platform Canvas, said it reached an agreement with the extortion group ShinyHunters to prevent data stolen in a recent breach from being leaked online. According to the company’s website, Canvas has more than 30 million active users worldwide and serves more than 8,000 institutions. Although Instructure did not disclose the terms of the arrangement, the statement strongly suggests a ransom payment was made. “We know that concerns about … More →
The post Instructure took a risky approach to recover stolen Canvas data appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/12160215/instructure-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 17:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Instructure, took, risky, approach, recover, stolen, Canvas, data</media:keywords>
</item>

<item>
<title>Amazon Quick authorization bypass let users reach blocked AI chat agents</title>
<link>https://block385.com/amazon-quick-authorization-bypass-let-users-reach-blocked-ai-chat-agents</link>
<guid>https://block385.com/amazon-quick-authorization-bypass-let-users-reach-blocked-ai-chat-agents</guid>
<description><![CDATA[ Enterprises running Amazon Quick, the AWS business intelligence and agentic AI service, rely on a feature called custom permissions to restrict who inside an account can use AI chat agents. Fog Security founder Jason Kao discovered that those restrictions were enforced only in the user interface for a period earlier this year, and direct calls to the backend API returned successful chat responses from agents that administrators had explicitly disabled. A locked door that was … More →
The post Amazon Quick authorization bypass let users reach blocked AI chat agents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/12110217/amazon_quick-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 17:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Amazon, Quick, authorization, bypass, let, users, reach, blocked, chat, agents</media:keywords>
</item>

<item>
<title>New TrickMo Variant Uses TON C2 and SOCKS5 to Create Android Network Pivots</title>
<link>https://block385.com/new-trickmo-variant-uses-ton-c2-and-socks5-to-create-android-network-pivots</link>
<guid>https://block385.com/new-trickmo-variant-uses-ton-c2-and-socks5-to-create-android-network-pivots</guid>
<description><![CDATA[ Cybersecurity researchers have flagged a new version of the TrickMo Android banking trojan that uses The Open Network (TON) for command-and-control (C2).
The new variant, observed by ThreatFabric between January and February 2026, has been observed actively targeting banking and cryptocurrency wallet users in France, Italy, and Austria.
&quot;TrickMo relies on a runtime-loaded APK  (dex.module), ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbBy7H5qvorFUmJqREACqqxVC0ogVq88dP8wLyKyUPF9fCowpUSkb7foEsEPDALt0ccCpcJc6PXCJjFmQo0oX3furU-cYPULBa0-pjpiLGV04JD6kr4G0VIrvFoJo54WmgjU1YocsquA15N3hxDmwt4i82QpYdil7F4fI0SMFVv9YCkbqqGKjIi-dEmcIx/s1600/tricks.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 16:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, TrickMo, Variant, Uses, TON, and, SOCKS5, Create, Android, Network, Pivots</media:keywords>
</item>

<item>
<title>Citrix moves secure access to a flexible, credit&#45;based consumption model</title>
<link>https://block385.com/citrix-moves-secure-access-to-a-flexible-credit-based-consumption-model</link>
<guid>https://block385.com/citrix-moves-secure-access-to-a-flexible-credit-based-consumption-model</guid>
<description><![CDATA[ Citrix has introduced Citrix Platform Flex, a secure access platform that combines software, management, and infrastructure to deliver managed desktops, enterprise browsing, and zero-trust access in a single offering. Built around workforce personas, Platform Flex replaces one-size-fits-all licensing with a flexible consumption model. Customers purchase a shared pool of Flex credits and allocate them based on the performance, security, and resilience needs of different worker types, adjusting usage as requirements change. The approach changes how … More →
The post Citrix moves secure access to a flexible, credit-based consumption model appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 15:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Citrix, moves, secure, access, flexible, credit-based, consumption, model</media:keywords>
</item>

<item>
<title>20 Leaders Who Built the CISO Era: 2 Decades of Change</title>
<link>https://block385.com/20-leaders-who-built-the-ciso-era-2-decades-of-change</link>
<guid>https://block385.com/20-leaders-who-built-the-ciso-era-2-decades-of-change</guid>
<description><![CDATA[ As part of Dark Reading&#039;s 20th anniversary special coverage, we profile the CISOs, founders, researchers, criminals, and policymakers who rewrote the enterprise risk playbook. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt75b70c94d4929df4/69fe0f027b0753efdf549e04/architect-Artur_Marciniec-alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 15:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Leaders, Who, Built, the, CISO, Era:, Decades, Change</media:keywords>
</item>

<item>
<title>JetBrains TeamCity vulnerability allows privilege escalation, API exposure (CVE&#45;2026&#45;44413)</title>
<link>https://block385.com/jetbrains-teamcity-vulnerability-allows-privilege-escalation-api-exposure-cve-2026-44413</link>
<guid>https://block385.com/jetbrains-teamcity-vulnerability-allows-privilege-escalation-api-exposure-cve-2026-44413</guid>
<description><![CDATA[ JetBrains has patched a high-severity vulnerability (CVE-2026-44413) in TeamCity, its popular continuous integration and continuous delivery platform, and is urging organizations with on-premises and self-managed deployments to upgrade to the fixed version or implement a security patch. About CVE-2026-44413 CVE-2026-44413 allows for privilege escalation, and may allow attackers to expose some parts of the TeamCity server API to unauthorized users. TeamCity’s REST API is extensive, with many endpoints, some of which may expose sensitive information … More →
The post JetBrains TeamCity vulnerability allows privilege escalation, API exposure (CVE-2026-44413) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/12133221/teamcity-glow-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 15:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>JetBrains, TeamCity, vulnerability, allows, privilege, escalation, API, exposure, CVE-2026-44413</media:keywords>
</item>

<item>
<title>Webinar: What the Riskiest SOC Alerts Go Unanswered &#45; and How Radiant Security Can Help</title>
<link>https://block385.com/webinar-what-the-riskiest-soc-alerts-go-unanswered-and-how-radiant-security-can-help</link>
<guid>https://block385.com/webinar-what-the-riskiest-soc-alerts-go-unanswered-and-how-radiant-security-can-help</guid>
<description><![CDATA[ Why do the Riskiest SOC Alerts Go Unanswered?
Security operations teams are drowning in alerts. But the real problem isn&#039;t always alert volume; it&#039;s the blind spots. The most dangerous alerts are the ones no one is investigating.
A recent report from The Hacker News examined why certain high-risk alert categories - WAF, DLP, OT/IoT, dark web intelligence, and supply chain signals- consistently ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA12ieHY1fiDaLvgyhGriQgzyEXJlSwwkQvcJXqP10JFEOcbwVa_EZD9H26tzLJovmlGHDHLL37-0H4y3ePSn5qDwRu6-X6I2StjAFHkiZ4_mgZOnjiKHdg2KId0sJ5OuxxWGeL7ULdNA3X_PTGcdv8_QJ4KS9RCtN-Oe3nLiOLWFwbDB46beV8jRaKG4/s1600/Radiant-webinar.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Webinar:, What, the, Riskiest, SOC, Alerts, Unanswered, and, How, Radiant, Security, Can, Help</media:keywords>
</item>

<item>
<title>Why Agentic AI Is Security&amp;apos;s Next Blind Spot</title>
<link>https://block385.com/why-agentic-ai-is-securitys-next-blind-spot</link>
<guid>https://block385.com/why-agentic-ai-is-securitys-next-blind-spot</guid>
<description><![CDATA[ Agentic AI is already running in production environments across many organizations today. It is executing tasks, consuming data, and taking actions — most likely without meaningful involvement from the security team. The industry conversation has largely framed this as a question of policy: allow it, restrict it, or monitor it? However, that framing misses the point. 
The more urgent ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzo1TUnQJpFnJbrO50dvjG14LDr2L6gKHsIIr5P73rSCgksrt2B9eVmRGKxPVvJ1qVMF63ka4So6vj5ln9T1nBIt2MV2DcH_dnYyQp1RREL4nbtnPghY7q5SAwZCwv0bN1ZV58DyTZSLw3UN00nP7uUcX_3ZqFQmAjufAvNRFshC5AJCuMdHb2n9kzC3w/s1600/ai-agents.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, Agentic, Securitys, Next, Blind, Spot</media:keywords>
</item>

<item>
<title>Six new dnsmasq vulnerabilities open the door to DNS cache poisoning, local root</title>
<link>https://block385.com/six-new-dnsmasq-vulnerabilities-open-the-door-to-dns-cache-poisoning-local-root</link>
<guid>https://block385.com/six-new-dnsmasq-vulnerabilities-open-the-door-to-dns-cache-poisoning-local-root</guid>
<description><![CDATA[ Recent disclosures have revealed that open-source networking tool dnsmasq is grappling with a serious set of vulnerabilities. The problems span memory safety and input validation, with researchers identifying heap buffer overflows, heap corruption, and code execution bugs among the issues. Taken together, the security flaws open the door to various attacks: poisoning cached DNS entries, slipping past security controls, crashing the dnsmasq process, and in certain scenarios, escalating privileges locally. To address all of this, … More →
The post Six new dnsmasq vulnerabilities open the door to DNS cache poisoning, local root appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/12123643/dnsmasq-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 13:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Six, new, dnsmasq, vulnerabilities, open, the, door, DNS, cache, poisoning, local, root</media:keywords>
</item>

<item>
<title>Škoda confirms unauthorized access to its online shop</title>
<link>https://block385.com/skoda-confirms-unauthorized-access-to-its-online-shop</link>
<guid>https://block385.com/skoda-confirms-unauthorized-access-to-its-online-shop</guid>
<description><![CDATA[ Car manufacturer Škoda discovered that attackers had exploited a vulnerability in its online shop software and gained temporary unauthorized access to the system. What happened? After discovering the incident, the company took the shop offline as a precautionary measure, fixed the vulnerability, referred the incident to a specialized IT forensics team for technical analysis, and reported it to the data protection supervisory authority. “Technical analysis has revealed that access to data stored in the shop … More →
The post Škoda confirms unauthorized access to its online shop appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/12105328/skoda-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 13:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Škoda, confirms, unauthorized, access, its, online, shop</media:keywords>
</item>

<item>
<title>Mini Shai&#45;Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI &amp;amp; More Packages</title>
<link>https://block385.com/mini-shai-hulud-worm-compromises-tanstack-mistral-ai-guardrails-ai-more-packages</link>
<guid>https://block385.com/mini-shai-hulud-worm-compromises-tanstack-mistral-ai-guardrails-ai-more-packages</guid>
<description><![CDATA[ TeamPCP, the threat actor behind the recent supply chain attack spree, has been linked to the compromise of the npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI as part of a fresh Mini Shai-Hulud campaign.
The affected npm packages have been modified to include an obfuscated JavaScript file (&quot;router_init.js&quot;) that&#039;s designed to profile the execution ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXIhs2kZt0YGdDcd-Io67mq1GIN_iI_71LYhuin4qqmlgUgCuZ3fGUvglg_5nh5DK8kfPP8RHki86yMyqh4rTE27PGgPBh4RQjkh91-QGoB8cav5NUsYAwcV3ZJ7aEf-uEoH3pLGQ2eWuCh8lZSWAlTIa2U5I6eeB3HZmYMn4q-YoV7Ytmkpr1tN0lC2rG/s1600/mistral.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 12:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mini, Shai-Hulud, Worm, Compromises, TanStack, Mistral, AI, Guardrails, More, Packages</media:keywords>
</item>

<item>
<title>OpenAI’s Daybreak uses Codex Security to identify risky attack paths</title>
<link>https://block385.com/openais-daybreak-uses-codex-security-to-identify-risky-attack-paths</link>
<guid>https://block385.com/openais-daybreak-uses-codex-security-to-identify-risky-attack-paths</guid>
<description><![CDATA[ OpenAI Daybreak is the company’s cybersecurity initiative focused on building AI-assisted software defense into the development process from the start. It combines OpenAI models, Codex Security, and cyber-focused GPT-5.5 variants to help organizations identify, validate, and prioritize software vulnerabilities. How Daybreak identifies exploitable vulnerabilities Daybreak builds editable threat models from a company’s code repository, analyzes realistic attack paths, validates likely vulnerabilities in isolated environments, and helps teams focus on exploitable issues instead of noisy alerts. … More →
The post OpenAI’s Daybreak uses Codex Security to identify risky attack paths appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/05155719/openai-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 11:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI’s, Daybreak, uses, Codex, Security, identify, risky, attack, paths</media:keywords>
</item>

<item>
<title>Instructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65TB Canvas Leak</title>
<link>https://block385.com/instructure-reaches-ransom-agreement-with-shinyhunters-to-stop-365tb-canvas-leak</link>
<guid>https://block385.com/instructure-reaches-ransom-agreement-with-shinyhunters-to-stop-365tb-canvas-leak</guid>
<description><![CDATA[ American educational technology company Instructure, the parent company of Canvas, said it reached an &quot;agreement&quot; with a decentralized cybercrime extortion group after it breached its network and threatened to leak stolen information from thousands of schools and universities.
In an update shared on Monday, the Utah-based firm said it &quot;reached an agreement with the unauthorized actor involved in ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiq_FVhPeK2Y77CmHxc0azDelzWwpgSb4m8GZPLeJlsr2QvCZU5ChGQK37bJ_2XsGQRaNszalreV1iNyYDzeLt1I8iqafNTvFCPFQ0czKwX3Q6Q23TqdavunyJJsy6X8vxG_jSz__X5BnFZc4AIIqr-kd0XiNcYgx3UnYaahiViFKAywuQ98a7bbtCPnwgo/s1600/ransom-breach.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 10:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Instructure, Reaches, Ransom, Agreement, with, ShinyHunters, Stop, 3.65TB, Canvas, Leak</media:keywords>
</item>

<item>
<title>OpenAI Launches Daybreak for AI&#45;Powered Vulnerability Detection and Patch Validation</title>
<link>https://block385.com/openai-launches-daybreak-for-ai-powered-vulnerability-detection-and-patch-validation</link>
<guid>https://block385.com/openai-launches-daybreak-for-ai-powered-vulnerability-detection-and-patch-validation</guid>
<description><![CDATA[ OpenAI has launched Daybreak, a new cybersecurity initiative that brings together frontier artificial intelligence (AI) model capabilities and Codex Security to help organizations identify and patch vulnerabilities before attackers find a way in using the same issues.
&quot;Daybreak combines the intelligence of OpenAI models, the extensibility of Codex as an agentic harness, and our partners across ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLWuBkkGzJLNmcxzqkKdh6dI6X-juFjpMWr-k6VGVTL6G1XZUH1sna06RS5PQY0e4A1VpUjvR-dpWMCx0yQJBdjFyjnoyOek-ysMpU7cgWBkUHChyADdRozT1XHNIvUhU_ibCkggQaGESD7St4aCfyx4SWOfLjUSuoeWiJQmmb1EkimfKA27g_tVHdV-G-/s1600/openai-daybreak.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 10:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI, Launches, Daybreak, for, AI-Powered, Vulnerability, Detection, and, Patch, Validation</media:keywords>
</item>

<item>
<title>HEIDI: Free IDE security plugin for open&#45;source vulnerability checks</title>
<link>https://block385.com/heidi-free-ide-security-plugin-for-open-source-vulnerability-checks</link>
<guid>https://block385.com/heidi-free-ide-security-plugin-for-open-source-vulnerability-checks</guid>
<description><![CDATA[ Open-source dependencies make up a large percentage of the code in production applications, and most vulnerability checks still run late in the pipeline, inside CI/CD systems or after a release ships. Meterian is moving those checks earlier with HEIDI, a free plugin for Visual Studio Code and JetBrains IDEs that flags vulnerable packages and offers one-click upgrades from inside the editor. HEIDI is also distributed through the OpenVSX registry and has recorded close to 5,000 … More →
The post HEIDI: Free IDE security plugin for open-source vulnerability checks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/11121336/heidi-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 09:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>HEIDI:, Free, IDE, security, plugin, for, open-source, vulnerability, checks</media:keywords>
</item>

<item>
<title>iOS 26.5 Brings Default End&#45;to&#45;End Encrypted RCS Messaging Between iPhone and Android</title>
<link>https://block385.com/ios-265-brings-default-end-to-end-encrypted-rcs-messaging-between-iphone-and-android</link>
<guid>https://block385.com/ios-265-brings-default-end-to-end-encrypted-rcs-messaging-between-iphone-and-android</guid>
<description><![CDATA[ Apple on Monday officially released iOS 26.5 with support for end-to-end encryption (E2EE) to Rich Communication Services (RCS) in beta as part of a &quot;cross-industry effort&quot; to replace traditional SMS with a more secure alternative.
To that end, E2EE RCS messaging is rolling out to iPhone users running iOS 26.5 with supported carriers and Android users on the latest version of Google Messages. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8hWB1CFFk1cxzc9VF7NI2QB-oCzrDMhxoIeajumiDRPkGyEt1wzhH3A3awM8uAZlRb2OXf33nd2O4Ug_IwHlCRNED92zQwFnDvyi9ypYQgQ8gRLCzkA6pHfJ2rfKfl-mTo5ha7KH2Jnwp9S6qIYx_6H4DnUSvVGM6k-yZfPQtKkO0pcGdhC4yVwI8-NEk/s1600/e2ee-rcs.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 08:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>iOS, 26.5, Brings, Default, End-to-End, Encrypted, RCS, Messaging, Between, iPhone, and, Android</media:keywords>
</item>

<item>
<title>Cybersecurity jobs available right now: May 12, 2026</title>
<link>https://block385.com/cybersecurity-jobs-available-right-now-may-12-2026</link>
<guid>https://block385.com/cybersecurity-jobs-available-right-now-may-12-2026</guid>
<description><![CDATA[ Application Security Engineer Total Quality Logistics | USA | On-site – View job details As an Application Security Engineer, you will design, implement, and maintain security controls across the software development lifecycle. You will work closely with engineering and product teams to identify vulnerabilities early, support remediation efforts, and help ensure applications are secure by design without slowing development. Cybersecurity Analyst – IOT Security Henry Ford Health | USA | On-site – View job details … More →
The post Cybersecurity jobs available right now: May 12, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/11140407/cybersecurity_jobs-3-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 07:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybersecurity, jobs, available, right, now:, May, 12, 2026</media:keywords>
</item>

<item>
<title>The hidden smart fridge risks that emerge years after purchase</title>
<link>https://block385.com/the-hidden-smart-fridge-risks-that-emerge-years-after-purchase</link>
<guid>https://block385.com/the-hidden-smart-fridge-risks-that-emerge-years-after-purchase</guid>
<description><![CDATA[ Household refrigerators are built to last more than a decade. The software, cloud services, and mobile apps that control them are not. A new analysis from Erik Buchmann at Leipzig University maps what happens when those two timelines collide, and the findings reach further than the kitchen. The study examines three current models on the market: the Bosch KGN36HI32, the Samsung RF27T5501SG, and the LG GSX960NEAZ. Each adds network connectivity, mobile control, and in some … More →
The post The hidden smart fridge risks that emerge years after purchase appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/11093559/smart_fridge-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 07:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, hidden, smart, fridge, risks, that, emerge, years, after, purchase</media:keywords>
</item>

<item>
<title>FCC Softens Ban on Foreign&#45;Made Routers</title>
<link>https://block385.com/fcc-softens-ban-on-foreign-made-routers</link>
<guid>https://block385.com/fcc-softens-ban-on-foreign-made-routers</guid>
<description><![CDATA[ The Federal Communications Commission eased some restrictions and pushed back deadlines for foreign router manufacturers, but the ban is still in place. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc4f403067dc54e94/6a02390040d9cd7e103541a1/router_Casezy_idea_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 01:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>FCC, Softens, Ban, Foreign-Made, Routers</media:keywords>
</item>

<item>
<title>Tech Can&amp;apos;t Stop These Threats — Your People Can</title>
<link>https://block385.com/tech-cant-stop-these-threats-your-people-can</link>
<guid>https://block385.com/tech-cant-stop-these-threats-your-people-can</guid>
<description><![CDATA[ Security controls can do only so much. Here are four attacks where your employees are usually your first, and only, line of cyber defense. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc92afe17dbd34016/6a022fb240d9cd336435418d/cyber_eye_Lightfield_Studios_Inc_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 12 May 2026 01:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tech, Cant, Stop, These, Threats, —, Your, People, Can</media:keywords>
</item>

<item>
<title>iOS 26.5 is out, bringing encrypted RCS messaging to iPhone and Android users</title>
<link>https://block385.com/ios-265-is-out-bringing-encrypted-rcs-messaging-to-iphone-and-android-users</link>
<guid>https://block385.com/ios-265-is-out-bringing-encrypted-rcs-messaging-to-iphone-and-android-users</guid>
<description><![CDATA[ Apple is bringing long-awaited end-to-end encryption to Rich Communication Services (RCS) messaging between iPhone and Android users in iOS 26.5. The feature is launching in beta for iPhone users running iOS 26.5 on supported carriers and Android users using the latest version of Google Messages. “When RCS messages are end-to-end encrypted, they can’t be read while they’re sent between devices,” Apple said. “Users will know that a conversation is end-to-end encrypted when they see a … More →
The post iOS 26.5 is out, bringing encrypted RCS messaging to iPhone and Android users appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/23105508/apple-chip.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>iOS, 26.5, out, bringing, encrypted, RCS, messaging, iPhone, and, Android, users</media:keywords>
</item>

<item>
<title>TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack</title>
<link>https://block385.com/teampcp-compromises-checkmarx-jenkins-ast-plugin-weeks-after-kics-supply-chain-attack</link>
<guid>https://block385.com/teampcp-compromises-checkmarx-jenkins-ast-plugin-weeks-after-kics-supply-chain-attack</guid>
<description><![CDATA[ Checkmarx has confirmed that a modified version of the Jenkins AST plugin was published to the Jenkins Marketplace.
&quot;If you are using Checkmarx Jenkins AST plugin, you need to ensure that you are using the version 2.0.13-829.vc72453fa_1c16 that was published on December 17, 2025 or previously,&quot; the cybersecurity company said in a statement over the weekend.
As of writing, Checkmarx has released ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiq0A3_8O89uC968dpFnFxE4v3J4fpr5nEqC-2QiSJ_rtZlgPocPYIaowCvCMeONhcrFiaoSdBVeNsuTa2ipAZZ3HBMUDcfO8DZ06pughteYJItHhMLeBr_jnfLL-5WX6xBE_EjIfPDGjCYyDCa6aImjimPNl7FtM1evdnTUVEk54x9pczRaFlmEZy1Cv8B/s1600/Jenkins.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 22:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TeamPCP, Compromises, Checkmarx, Jenkins, AST, Plugin, Weeks, After, KICS, Supply, Chain, Attack</media:keywords>
</item>

<item>
<title>Hackers Used AI to Develop First Known Zero&#45;Day 2FA Bypass for Mass Exploitation</title>
<link>https://block385.com/hackers-used-ai-to-develop-first-known-zero-day-2fa-bypass-for-mass-exploitation</link>
<guid>https://block385.com/hackers-used-ai-to-develop-first-known-zero-day-2fa-bypass-for-mass-exploitation</guid>
<description><![CDATA[ Google on Monday disclosed that it identified an unknown threat actor using a zero-day exploit that it said was likely developed with an artificial intelligence (AI) system, marking the first time the technology has been put to use in the wild in a malicious context for vulnerability discovery and exploit generation.
The activity is said to be the work of cybercrime threat actors who appear to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgF329-zAoI4gwIW3h3gRYiDJjcRSyWPM4DLHFQwNNGfLTVaROqIfQZ0QB1FwWGmvMGuyNAF9Q6QBYcwLsqMsCka5Lqu82CzUbrBULnUDQwtY_4z6KiOEKSETes6as77XfUCaJVBUOCovZz8jajp6vBp9AAjHiS7BEviANEH0FxmzZwdrTapD3R-gPQWKJ1/s1600/ai-hacker.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hackers, Used, Develop, First, Known, Zero-Day, 2FA, Bypass, for, Mass, Exploitation</media:keywords>
</item>

<item>
<title>cPanel CVE&#45;2026&#45;41940 Under Active Exploitation to Deploy Filemanager Backdoor</title>
<link>https://block385.com/cpanel-cve-2026-41940-under-active-exploitation-to-deploy-filemanager-backdoor</link>
<guid>https://block385.com/cpanel-cve-2026-41940-under-active-exploitation-to-deploy-filemanager-backdoor</guid>
<description><![CDATA[ A threat actor named Mr_Rot13 has been attributed to the exploitation of a recently disclosed critical cPanel flaw to deploy a backdoor codenamed Filemanager on compromised environments.
The attack exploits CVE-2026-41940, a vulnerability impacting cPanel and WebHost Manager (WHM) that could result in an authentication bypass and allow remote attackers to gain elevated control of the control ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgInpdPoL0Kf1i9D6daAAGB1QPCR3E0d_ArELz-ks1Y6cJ_low0jdZYqamKMKMxC12OC-XMwUrDIWdh_xK_d7zLLQfH-rDl0-Vi_VSsFswAuJL0mEtQg-FW66c_1it8d59p2An-T3_oQJ_Q_yHLiX0PHtEq2OdLcGXwxniVKGJGLusWdjJfP7M-H9ADm8cK/s1600/cpcp.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 20:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>cPanel, CVE-2026-41940, Under, Active, Exploitation, Deploy, Filemanager, Backdoor</media:keywords>
</item>

<item>
<title>Poor security left hackers inside water company network for nearly two years</title>
<link>https://block385.com/poor-security-left-hackers-inside-water-company-network-for-nearly-two-years</link>
<guid>https://block385.com/poor-security-left-hackers-inside-water-company-network-for-nearly-two-years</guid>
<description><![CDATA[ The UK’s data protection regulator, the Information Commissioner’s Office (ICO), fined South Staffordshire Water’s parent company £963,900 over security failures linked to a cyberattack that exposed the personal data of 633,887 people. According to the ICO, the South Staffordshire breach began in September 2020 with a phishing email that tricked an employee into opening an attachment, allowing attackers to install malicious software inside the company’s network. The intrusion remained undetected for 20 months. “The breach … More →
The post Poor security left hackers inside water company network for nearly two years appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/06/29115411/tekz6666_justice_law_computer_keyboard_343e48d3-44fb-4ffc-911f-2ce012d904ec.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 19:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Poor, security, left, hackers, inside, water, company, network, for, nearly, two, years</media:keywords>
</item>

<item>
<title>Red Hat extends open source technology into space</title>
<link>https://block385.com/red-hat-extends-open-source-technology-into-space</link>
<guid>https://block385.com/red-hat-extends-open-source-technology-into-space</guid>
<description><![CDATA[ Red Hat and Voyager Technologies announced the successful deployment of Red Hat Enterprise Linux 10.1 and Red Hat Universal Base Image (UBI) to Voyager’s LEOcloud Space Edge IaaS Micro Datacenter aboard the International Space Station (ISS). This collaboration extends a container-optimized, enterprise Linux platform into orbit, providing a more consistent and hardened operating foundation for AI-ready workloads to run in space. The milestone advances the evolution of space-based cloud services and orbital data centers (ODCs), … More →
The post Red Hat extends open source technology into space appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 19:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Red, Hat, extends, open, source, technology, into, space</media:keywords>
</item>

<item>
<title>&amp;apos;Dirty Frag&amp;apos; Exploit Poised to Blow Up on Enterprise Linux Distros</title>
<link>https://block385.com/dirty-frag-exploit-poised-to-blow-up-on-enterprise-linux-distros</link>
<guid>https://block385.com/dirty-frag-exploit-poised-to-blow-up-on-enterprise-linux-distros</guid>
<description><![CDATA[ The privilege escalation vulnerability, which is similar to other Linux flaws like Copy Fail and Dirty Pipe, may already be under limited exploitation. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6294394cb13e6ebe/6a01bfb65f98bb6fdefc0215/bombs-Valeriy_Kachaev-Alamy.png" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 19:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Dirty, Frag, Exploit, Poised, Blow, Enterprise, Linux, Distros</media:keywords>
</item>

<item>
<title>Zimperium Mobile App Response Agent helps security teams counter mobile attacks</title>
<link>https://block385.com/zimperium-mobile-app-response-agent-helps-security-teams-counter-mobile-attacks</link>
<guid>https://block385.com/zimperium-mobile-app-response-agent-helps-security-teams-counter-mobile-attacks</guid>
<description><![CDATA[ Zimperium launched Mobile App Response Agent, enabling security teams to respond faster than ever before to fraud and security threats. Leveraging Zimperium’s expertise in mobile security, Mobile App Response Agent is part of Zimperium’s Mobile App Protection Suite (MAPS), empowering SOC and fraud teams to assess attacks on their mobile app before they result in fraud or a breach by reducing the time required for investigation, confirmation and response from hours or days, to just … More →
The post Zimperium Mobile App Response Agent helps security teams counter mobile attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 19:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Zimperium, Mobile, App, Response, Agent, helps, security, teams, counter, mobile, attacks</media:keywords>
</item>

<item>
<title>Alation AI Governance creates a system of record for AI oversight</title>
<link>https://block385.com/alation-ai-governance-creates-a-system-of-record-for-ai-oversight</link>
<guid>https://block385.com/alation-ai-governance-creates-a-system-of-record-for-ai-oversight</guid>
<description><![CDATA[ Alation has introduced Alation AI Governance, a new offering that gives enterprises the system of record they are missing for AI compliance. Enterprises are deploying AI models, agents, and tools faster than they can govern them. As a result, when a board or regulator asks about compliance, most Chief Data Officers (CDOs) and their teams spend weeks manually assembling evidence. AI approval workflows live in email threads and SharePoint pages. Model documentation goes stale the … More →
The post Alation AI Governance creates a system of record for AI oversight appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 17:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Alation, Governance, creates, system, record, for, oversight</media:keywords>
</item>

<item>
<title>Google researchers uncover criminal zero&#45;day exploit likely built with AI</title>
<link>https://block385.com/google-researchers-uncover-criminal-zero-day-exploit-likely-built-with-ai</link>
<guid>https://block385.com/google-researchers-uncover-criminal-zero-day-exploit-likely-built-with-ai</guid>
<description><![CDATA[ Google’s threat intelligence researchers have linked a zero-day exploit to AI-assisted development by a criminal group. The exploit targeted a popular open-source web-based system administration tool. It allowed attackers to bypass two-factor authentication once they had valid user credentials. The flaw stemmed from a semantic logic error, a case where a developer hardcoded a trust assumption that contradicted the application’s authentication enforcement. Google Threat Intelligence Group (GTIG) worked with the impacted vendor to disclose the … More →
The post Google researchers uncover criminal zero-day exploit likely built with AI appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/10114938/google-ai-robot.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 17:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, researchers, uncover, criminal, zero-day, exploit, likely, built, with</media:keywords>
</item>

<item>
<title>Hackers Use AI for Exploit Development, Attack Automation</title>
<link>https://block385.com/hackers-use-ai-for-exploit-development-attack-automation</link>
<guid>https://block385.com/hackers-use-ai-for-exploit-development-attack-automation</guid>
<description><![CDATA[ Cyber adversaries have long used AI, but now attackers are using large language models to develop exploits and orchestrate complex attacks. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blta6129261e6e03886/69fe1d8aac518193326b56b8/AI_orchestration_NicoElNino_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 17:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hackers, Use, for, Exploit, Development, Attack, Automation</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, WebSocket Skimmers and More</title>
<link>https://block385.com/weekly-recap-linux-rootkit-macos-crypto-stealer-websocket-skimmers-and-more</link>
<guid>https://block385.com/weekly-recap-linux-rootkit-macos-crypto-stealer-websocket-skimmers-and-more</guid>
<description><![CDATA[ Rough Monday.
Somebody poisoned a trusted download again, somebody else turned cloud servers into public housing, and a few crews are still getting into boxes with bugs that should’ve died years ago — the same old holes, same lazy access paths, same “how the hell is this still open” feeling. One report this week basically reads like a guy tripped over root access by accident and decided to stay ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiD4a3gzeAEAv4Bs5FqWbHG1cRyNqIOjygeSxxpNoChwyyMUWlbZHzkG0n8ysGpoAYuKqklfMtTKRct0OeYktaKLhdXpRH5pKH94tVaMX7iPeNDf7vZjFky3myBkFPJPl1xIdsWDlIYP30IeR7IZGhQZ5p82yHRdRO1OGkpAtTWgZcQSG3zXqh9tLbSSrgP/s1600/cyber-recap.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>⚡, Weekly, Recap:, Linux, Rootkit, macOS, Crypto, Stealer, WebSocket, Skimmers, and, More</media:keywords>
</item>

<item>
<title>Police take down relaunched criminal marketplace with 22,000 users, €3.6 million in revenue</title>
<link>https://block385.com/police-take-down-relaunched-criminal-marketplace-with-22000-users-36-million-in-revenue</link>
<guid>https://block385.com/police-take-down-relaunched-criminal-marketplace-with-22000-users-36-million-in-revenue</guid>
<description><![CDATA[ German authorities shut down a relaunched version of the criminal marketplace Crimenetwork and arrested its suspected operator. The domain seizure notice (Source: BKA) A special unit of the Spanish National Police arrested the suspected 35-year-old German operator at his residence in Mallorca under a European Arrest Warrant. The suspect is accused of operating criminal trading platforms on the internet under Section 127 of the German Criminal Code, as well as trafficking narcotics in quantities covered … More →
The post Police take down relaunched criminal marketplace with 22,000 users, €3.6 million in revenue appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/28154436/sentence-court5-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 15:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Police, take, down, relaunched, criminal, marketplace, with, 22, 000, users, €3.6, million, revenue</media:keywords>
</item>

<item>
<title>SailPoint Agentic Fabric expands identity governance to autonomous AI agents</title>
<link>https://block385.com/sailpoint-agentic-fabric-expands-identity-governance-to-autonomous-ai-agents</link>
<guid>https://block385.com/sailpoint-agentic-fabric-expands-identity-governance-to-autonomous-ai-agents</guid>
<description><![CDATA[ SailPoint has introduced SailPoint Agentic Fabric, a new platform designed to help enterprises secure AI agents and other non-human identities at scale. As organizations deploy autonomous AI agents across cloud environments, applications, and endpoints, they face a growing governance gap. Unlike traditional users, AI agents can act at machine speed, often without clear ownership, oversight, or consistent controls. As these non-human identities multiply, enterprises need a way to extend identity security beyond human users to … More →
The post SailPoint Agentic Fabric expands identity governance to autonomous AI agents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 15:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SailPoint, Agentic, Fabric, expands, identity, governance, autonomous, agents</media:keywords>
</item>

<item>
<title>Cyber Espionage Group Targets Aviation Firms to Steal Map Data</title>
<link>https://block385.com/cyber-espionage-group-targets-aviation-firms-to-steal-map-data</link>
<guid>https://block385.com/cyber-espionage-group-targets-aviation-firms-to-steal-map-data</guid>
<description><![CDATA[ The campaign quietly compromises aerospace and drone operators to exfiltrate GIS files, terrain models, and GPS data and gain a clear picture of adversaries&#039; world view. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltcdb68c050b92d44f/69fe24d5757b4d3f64b57d8a/drone-mapping-system-DC_Studio-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 15:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cyber, Espionage, Group, Targets, Aviation, Firms, Steal, Map, Data</media:keywords>
</item>

<item>
<title>Linux developers weigh emergency “killswitch” for vulnerable kernel functions</title>
<link>https://block385.com/linux-developers-weigh-emergency-killswitch-for-vulnerable-kernel-functions</link>
<guid>https://block385.com/linux-developers-weigh-emergency-killswitch-for-vulnerable-kernel-functions</guid>
<description><![CDATA[ Linux kernel developers are reviewing a proposal for an emergency risk mitigation mechanism (“Killswitch”) that would allow administrators to disable vulnerable kernel functions at runtime. The proposal, submitted by Linux kernel developer/maintainer Sasha Levin, arrives in the wake of the public disclosure of two privilege escalation vulnerabilities affecting the Linux kernel. What prompted the proposal The impetus for the proposal is explicit: the patch’s selftest references Copy Fail (CVE-2026-31431), a nine-year-old local privilege escalation flaw … More →
The post Linux developers weigh emergency “killswitch” for vulnerable kernel functions appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/11144606/linux-tux.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 15:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Linux, developers, weigh, emergency, “killswitch”, for, vulnerable, kernel, functions</media:keywords>
</item>

<item>
<title>Your Purple Team Isn&amp;apos;t Purple — It&amp;apos;s Just Red and Blue in the Same Room</title>
<link>https://block385.com/your-purple-team-isnt-purple-its-just-red-and-blue-in-the-same-room</link>
<guid>https://block385.com/your-purple-team-isnt-purple-its-just-red-and-blue-in-the-same-room</guid>
<description><![CDATA[ Defending a network at 2 am looks a lot like this: an analyst copy-pasting a hash from a PDF into a SIEM query. A red team script is being rewritten by hand so the blue team can use it. A patch waiting on a change-approval window that&#039;s longer than the exploitation window itself.
Nobody in that chain is incompetent. Every human is doing their job correctly. The problem is the system, its ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0dlupn761jekig7BbPagwo6DtccMFQV8oESHiCBIs04DdhvoVtfwhe7OVEh8VvyFpa-VFo9GKWL8tx2ZKTSn3qA7iAFCvTfoevjyPFYNb3eAmpp4pkWk3mcQd_AulszHJoxUa6z_k_Nr_KB9Ny_hoZWy1VVA-U9BV2nPvESGGqPE5r4_AbNlid_BK-M8/s1600/picus.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Your, Purple, Team, Isnt, Purple, —, Its, Just, Red, and, Blue, the, Same, Room</media:keywords>
</item>

<item>
<title>The scam economy has found its AI upgrade</title>
<link>https://block385.com/the-scam-economy-has-found-its-ai-upgrade</link>
<guid>https://block385.com/the-scam-economy-has-found-its-ai-upgrade</guid>
<description><![CDATA[ Scam attempts continue to reach consumers via email, text messages, social media, online advertising, and phone calls. The volume of exposure has remained stable over the past year, with more than half of consumers encountering scam attempts at least monthly, according to the F-Secure Scam Intelligence &amp; Impacts Report 2026. Most common channels for scam attempts (Source: F-Secure) The United States recorded the highest exposure levels among surveyed markets. Younger consumers reported higher scam activity … More →
The post The scam economy has found its AI upgrade appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/24104430/user-danger-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 13:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, scam, economy, has, found, its, upgrade</media:keywords>
</item>

<item>
<title>The questionnaire&#45;based TPRM model is broken, and TrustCloud has a fix</title>
<link>https://block385.com/the-questionnaire-based-tprm-model-is-broken-and-trustcloud-has-a-fix</link>
<guid>https://block385.com/the-questionnaire-based-tprm-model-is-broken-and-trustcloud-has-a-fix</guid>
<description><![CDATA[ TrustCloud announced a new version of TrustLens, its third party risk management (TPRM) solution. The new TrustLens agentic AI capabilities focus on delivering four requirements every CISO wants in their TPRM program: speed, accuracy, coverage, and proactive risk mitigation. In the latest TrustLens deployments, a Global 2000 life sciences customer leveraged the TPRM AI agent within TrustLens to assist their human agents. As a result, they were able to assess more than 5000 suppliers in … More →
The post The questionnaire-based TPRM model is broken, and TrustCloud has a fix appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 13:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, questionnaire-based, TPRM, model, broken, and, TrustCloud, has, fix</media:keywords>
</item>

<item>
<title>Instagram messaging encryption removed, and privacy advocates are pushing back</title>
<link>https://block385.com/instagram-messaging-encryption-removed-and-privacy-advocates-are-pushing-back</link>
<guid>https://block385.com/instagram-messaging-encryption-removed-and-privacy-advocates-are-pushing-back</guid>
<description><![CDATA[ After introducing optional end-to-end encrypted messaging in 2023, Instagram announced in March 2026 that encryption for direct messages would be discontinued, and the feature was removed on May 8. The change allows Instagram to access direct message content, including images, videos, and voice notes. “If you have chats that are affected by this change, you will see instructions on how you can download any media or messages that you may want to keep,” the company … More →
The post Instagram messaging encryption removed, and privacy advocates are pushing back appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/01/12100734/instagram-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 13:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Instagram, messaging, encryption, removed, and, privacy, advocates, are, pushing, back</media:keywords>
</item>

<item>
<title>Fake OpenAI Privacy Filter Repo Hits #1 on Hugging Face, Draws 244K Downloads</title>
<link>https://block385.com/fake-openai-privacy-filter-repo-hits-1-on-hugging-face-draws-244k-downloads</link>
<guid>https://block385.com/fake-openai-privacy-filter-repo-hits-1-on-hugging-face-draws-244k-downloads</guid>
<description><![CDATA[ A malicious Hugging Face repository managed to take a spot in the platform&#039;s trending list by impersonating OpenAI&#039;s Privacy Filter open-weight model to deliver a Rust-based information stealer to Windows users.
The project, named Open-OSS/privacy-filter, masqueraded as its legitimate counterpart, released by OpenAI late last month (openai/privacy-filter), including copying the entire ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPtLFShq_XoM9Nzsl5kmSsF2UGsm6VhRoLNodcqRCdq45zqy4ekFVtamokNzEFifQknD502Wc0uFTBUdvLsBsYn4QAeVHSWLmhF2ROBMXutev8T6JjCGrrarzLhkSTUHLBq-nEWrF0WTb2epkX_3Ba5a6Gv_21R7PPQ_zCjhk7OU702Y10tJkcJiYG52D4/s1600/hugging-face-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 10:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fake, OpenAI, Privacy, Filter, Repo, Hits, Hugging, Face, Draws, 244K, Downloads</media:keywords>
</item>

<item>
<title>Security teams are turning to AI to survive alert overload</title>
<link>https://block385.com/security-teams-are-turning-to-ai-to-survive-alert-overload</link>
<guid>https://block385.com/security-teams-are-turning-to-ai-to-survive-alert-overload</guid>
<description><![CDATA[ The World Economic Forum white paper “Empowering Defenders: AI for Cybersecurity” identified AI as the biggest driver of change in cybersecurity for 94% of survey respondents. The paper found that 77% of organizations already use AI in cybersecurity, with much of the activity focused on phishing detection, anomaly monitoring, vulnerability management and incident response. “AI has the potential to shift the balance towards defenders,” said Akshay Joshi, Head of the Centre for Cybersecurity, World Economic … More →
The post Security teams are turning to AI to survive alert overload appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/24104332/ai-person-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 09:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Security, teams, are, turning, survive, alert, overload</media:keywords>
</item>

<item>
<title>Review: Foundations of Cybersecurity, 2nd edition</title>
<link>https://block385.com/review-foundations-of-cybersecurity-2nd-edition</link>
<guid>https://block385.com/review-foundations-of-cybersecurity-2nd-edition</guid>
<description><![CDATA[ Jason Andress has refreshed his introductory security text for No Starch Press. He writes in the introduction that the term security now extends past data center servers to cloud resources, mobile devices, the Internet of Things, and AI. About the author Jason Andress is an experienced security professional with 15+ years in the industry. He has been writing on security topics for over a decade, covering data security, network security, hardware security, penetration testing, and … More →
The post Review: Foundations of Cybersecurity, 2nd edition appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/07140827/book-foundations-cybersecurity-2e-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 09:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Review:, Foundations, Cybersecurity, 2nd, edition</media:keywords>
</item>

<item>
<title>Rustinel: Open&#45;source endpoint detection for Windows and Linux</title>
<link>https://block385.com/rustinel-open-source-endpoint-detection-for-windows-and-linux</link>
<guid>https://block385.com/rustinel-open-source-endpoint-detection-for-windows-and-linux</guid>
<description><![CDATA[ Open-source endpoint detection has long been split between Windows-focused tools built around Sysmon and Linux tools built around eBPF or auditd. Defenders running mixed environments have had to stitch together separate pipelines, separate rule sets, and separate maintenance burdens. Rustinel, a Rust-based endpoint agent, is an attempt to collapse that work into a single codebase. A single agent across two operating systems Rustinel collects telemetry through ETW on Windows and eBPF on Linux, normalizes the … More →
The post Rustinel: Open-source endpoint detection for Windows and Linux appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/05161542/rustinel-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 11 May 2026 09:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Rustinel:, Open-source, endpoint, detection, for, Windows, and, Linux</media:keywords>
</item>

<item>
<title>Ollama Out&#45;of&#45;Bounds Read Vulnerability Allows Remote Process Memory Leak</title>
<link>https://block385.com/ollama-out-of-bounds-read-vulnerability-allows-remote-process-memory-leak</link>
<guid>https://block385.com/ollama-out-of-bounds-read-vulnerability-allows-remote-process-memory-leak</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed a critical security vulnerability in Ollama that, if successfully exploited, could allow a remote, unauthenticated attacker to leak its entire process memory.
The out-of-bounds read flaw, which likely impacts over 300,000 servers globally, is tracked as CVE-2026-7482 (CVSS score: 9.1). It has been codenamed Bleeding Llama by Cyera.
Ollama is a ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj92eUjjTTMJPizvUJGwq7Ych7nrXHwGRNt3hS9yjNGRJk5d3pdIKjeZhQDVuFp0DnKjP4qoieGWFjswm7nHDLBaxWC3DxFIfLfRjMSEXd0Ta04vcTrbCpS9PEXebUUbMBxBt0VOb-PKVk-7Cq0FjuMXl4VtKneb5a3ujCo872goPN22GBFFhReJtWsQJLK/s1600/oll.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 10 May 2026 16:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ollama, Out-of-Bounds, Read, Vulnerability, Allows, Remote, Process, Memory, Leak</media:keywords>
</item>

<item>
<title>Week in review: cPanel vulnerability actively exploited, DigiCert breach, LinkedIn job scams</title>
<link>https://block385.com/week-in-review-cpanel-vulnerability-actively-exploited-digicert-breach-linkedin-job-scams</link>
<guid>https://block385.com/week-in-review-cpanel-vulnerability-actively-exploited-digicert-breach-linkedin-job-scams</guid>
<description><![CDATA[ Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Your work apps are quietly handing 19 data points to someone Office work in 2026 relies on mobile apps used alongside personal tools like banking and messaging. Ten widely used workplace apps, including Gmail, Microsoft Teams, Zoom, Slack, and Notion, have over 12.5 billion Google Play downloads. Research from Incogni shows these apps collect an average of 19 data points … More →
The post Week in review: cPanel vulnerability actively exploited, DigiCert breach, LinkedIn job scams appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/07/16184227/week-in-review.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 10 May 2026 11:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Week, review:, cPanel, vulnerability, actively, exploited, DigiCert, breach, LinkedIn, job, scams</media:keywords>
</item>

<item>
<title>cPanel, WHM Release Fixes for Three New Vulnerabilities — Patch Now</title>
<link>https://block385.com/cpanel-whm-release-fixes-for-three-new-vulnerabilities-patch-now</link>
<guid>https://block385.com/cpanel-whm-release-fixes-for-three-new-vulnerabilities-patch-now</guid>
<description><![CDATA[ cPanel has released updates to address three vulnerabilities in cPanel and Web Host Manager (WHM) that could be exploited to achieve privilege escalation, code execution, and denial-of-service.
The list of vulnerabilities is as follows -

CVE-2026-29201 (CVSS score: 4.3) - An insufficient input validation of the feature file name in the &quot;feature::LOADFEATUREFILE&quot; adminbin call that could result ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8HLwOMzo20kbZmflPvJJmY7su6wWOWgDLV-dJNx-k76m5ivbwVoCkFrnsLXkyO4PHAyLSkPXinjK71SDmWabyOcTlKb3juZgkXTzOVuMvZk6-LUFMhoJ-UGFvv0qEby7QmYcjTWn1m1L19VTKeB7CdmKvpvIP5ifniLO92ARSLjtf8rcXIbm8AFMZei-M/s1600/cpanel-3.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 09 May 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>cPanel, WHM, Release, Fixes, for, Three, New, Vulnerabilities, —, Patch, Now</media:keywords>
</item>

<item>
<title>ShinyHunters Claims Second Attack Against Instructure</title>
<link>https://block385.com/shinyhunters-claims-second-attack-against-instructure</link>
<guid>https://block385.com/shinyhunters-claims-second-attack-against-instructure</guid>
<description><![CDATA[ The edtech company is struggling to wrest control from its hackers. PII belonging to hundreds of millions of people is on the line. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt7bbbe83a6784235d/69fe32ca50b7f73288ba7eeb/Instructure-Kristoffer_Tripplaar-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 23:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ShinyHunters, Claims, Second, Attack, Against, Instructure</media:keywords>
</item>

<item>
<title>TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook Worms</title>
<link>https://block385.com/tclbanker-banking-trojan-targets-financial-platforms-via-whatsapp-and-outlook-worms</link>
<guid>https://block385.com/tclbanker-banking-trojan-targets-financial-platforms-via-whatsapp-and-outlook-worms</guid>
<description><![CDATA[ Threat hunters have flagged a previously undocumented Brazilian banking trojan dubbed TCLBANKER that&#039;s capable of targeting 59 banking, fintech, and cryptocurrency platforms.
The activity is being tracked by Elastic Security Labs under the moniker REF3076. The malware family is assessed to be a major update of the Maverick, which is known to leverage a worm called SORVEPOTEL to spread via ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWchpptUYeW4vXSUXfGq-uMzB1mr_dzsvX8XIWssIKzaWa4_eYbaLwec5Zos3xCoD0s8-LDcGI7Vj8DjFq6RtUY68HP21YudHYdsFS2xdyzQE7OPyuTlqyO2X9uwlSCRuVl9tAUwq0mvGuXlYkxjdmC7ynyAcIDpbejkR45ucf_L3VCDupSZMteOby7BUp/s1600/banking.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 20:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TCLBANKER, Banking, Trojan, Targets, Financial, Platforms, via, WhatsApp, and, Outlook, Worms</media:keywords>
</item>

<item>
<title>Fake Call History Apps Stole Payments From Users After 7.3 Million Play Store Downloads</title>
<link>https://block385.com/fake-call-history-apps-stole-payments-from-users-after-73-million-play-store-downloads</link>
<guid>https://block385.com/fake-call-history-apps-stole-payments-from-users-after-73-million-play-store-downloads</guid>
<description><![CDATA[ Cybersecurity researchers have discovered fraudulent apps on the official Google Play Store for Android that falsely claimed to offer access to call histories for any phone number, only to trick users into joining a subscription that provided fake data and incurred financial loss.
The 28 apps have collectively racked up more than 7.3 million downloads, with one of them alone accounting for over ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgBMXgW6K0BZvt0-jhZ_smX3Uy-nsd9wb9g7Gs7d3G7uH-HIlEcNhEt9xpaKD_62iJol_LK5Expt-6qCuvIf7llqtQclB64I9zZm_i8CIC0lMJiIz8nx6r4C-Nj4cUgd3cQEtu3_lGFa7wcmR6q9otQhCLoB1Mbnmn7NgH6-djLs_ScqanZFNC-EVOwYyO7/s1600/android-calls.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 18:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fake, Call, History, Apps, Stole, Payments, From, Users, After, 7.3, Million, Play, Store, Downloads</media:keywords>
</item>

<item>
<title>Dirty Frag: Unpatched Linux vulnerability delivers root access</title>
<link>https://block385.com/dirty-frag-unpatched-linux-vulnerability-delivers-root-access</link>
<guid>https://block385.com/dirty-frag-unpatched-linux-vulnerability-delivers-root-access</guid>
<description><![CDATA[ A week after Copy Fail, another Linux local privilege escalation vulnerability dubbed “Dirty Frag” has been revealed, along with a PoC exploit. What is Dirty Frag In effect, Dirty Frag refers to two flaws: A xfrm-ESP Page-Cache Write vulnerability (CVE-2026-43284, aka Copy Fail 2.0), now patched in the Linux kernel, affects the modules supporting one of the protocols used for IPsec A RxRPC Page-Cache Write vulnerability (CVE number reserved: CVE-2026-43500), currently unpatched, affects the modules … More →
The post Dirty Frag: Unpatched Linux vulnerability delivers root access appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/10/07141728/linux-fire-1.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 17:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Dirty, Frag:, Unpatched, Linux, vulnerability, delivers, root, access</media:keywords>
</item>

<item>
<title>AI&#45;Driven Cyberattack on Mexico Couldn&amp;apos;t Breach OT Systems</title>
<link>https://block385.com/ai-driven-cyberattack-on-mexico-couldnt-breach-ot-systems</link>
<guid>https://block385.com/ai-driven-cyberattack-on-mexico-couldnt-breach-ot-systems</guid>
<description><![CDATA[ The most sophisticated AI-integrated campaign to date hit a brick wall in the form of a SCADA login screen. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt98fa61979c1de1b0/69fb95aa4f86c99808c8fc96/Faucet-Steven_Liveoak-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 17:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AI-Driven, Cyberattack, Mexico, Couldnt, Breach, Systems</media:keywords>
</item>

<item>
<title>VoidStealer Malware Darts Past Google Chrome&amp;apos;s Encryption</title>
<link>https://block385.com/voidstealer-malware-darts-past-google-chromes-encryption</link>
<guid>https://block385.com/voidstealer-malware-darts-past-google-chromes-encryption</guid>
<description><![CDATA[ Authors of the VoidStealer Trojan uncovered yet another way to get around Google&#039;s App-Bound Encryption (ABE), opening the door to infostealers. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0b9267d0fd783b29/69fba7aa14132e45944be6c4/cookies_izzuanroslan_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 17:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>VoidStealer, Malware, Darts, Past, Google, Chromes, Encryption</media:keywords>
</item>

<item>
<title>One Missed Threat Per Week: What 25M Alerts Reveal About Low&#45;Severity Risk</title>
<link>https://block385.com/one-missed-threat-per-week-what-25m-alerts-reveal-about-low-severity-risk</link>
<guid>https://block385.com/one-missed-threat-per-week-what-25m-alerts-reveal-about-low-severity-risk</guid>
<description><![CDATA[ The dark secret of enterprise security operations is that defenders have quietly institutionalized the practice of not looking. This is not just anecdotal, but rather backed by a recent report investigating more than 25 million security alerts, including informational and low-severity, across live enterprise environments. 
The dataset behind these findings includes 10 million monitored ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjUaPw5V89Ez9z5x8eFLFOhwPphGqXDQVGfd2sI-pX9Q1XTcpYlWEhFiZ6o12fzAyvtCFDQ0zs4AFlHl4HJNnjWH8hUXM9r_-oBl7YMEnU1F41Ho7DL23NJbgG4M3eoqF6CTZWqFtFcw0gOB8QfkCPW1_xQ-HwmvWr3GMzEeRFbC8SLgG5LsdnopTAHDOs/s1600/ai-soc.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>One, Missed, Threat, Per, Week:, What, 25M, Alerts, Reveal, About, Low-Severity, Risk</media:keywords>
</item>

<item>
<title>New Linux PamDOORa Backdoor Uses PAM Modules to Steal SSH Credentials</title>
<link>https://block385.com/new-linux-pamdoora-backdoor-uses-pam-modules-to-steal-ssh-credentials</link>
<guid>https://block385.com/new-linux-pamdoora-backdoor-uses-pam-modules-to-steal-ssh-credentials</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a new Linux backdoor named PamDOORa that&#039;s being advertised on the Rehub Russian cybercrime forum for $1,600 by a threat actor called &quot;darkworm.&quot;
The backdoor is designed as a Pluggable Authentication Module (PAM)-based post-exploitation toolkit that enables persistent SSH access by means of a magic password and specific TCP port combination. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixNgyNI9ObZi3Il87CVXhEWyWgcK-O1IKhQKRs7NPrNVqTMBZRw7AZpmbk5RdsPxNPmO9IyXaq6QzYBN691HBgfE8HpwnyJuE4-vaCAwHPpb6UfeSRcrMI-GRjcX53cELs31s7ps6YkGx5bAAB67w4m9GQ7ZVWjSdnaPOFczjHlsS3967ZvBh-4ZvTBWEJ/s1600/linux-pam.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Linux, PamDOORa, Backdoor, Uses, PAM, Modules, Steal, SSH, Credentials</media:keywords>
</item>

<item>
<title>Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise</title>
<link>https://block385.com/quasar-linux-rat-steals-developer-credentials-for-software-supply-chain-compromise</link>
<guid>https://block385.com/quasar-linux-rat-steals-developer-credentials-for-software-supply-chain-compromise</guid>
<description><![CDATA[ A previously undocumented Linux implant codenamed Quasar Linux RAT (QLNX) is targeting developers&#039; systems to establish a silent foothold as well as facilitate a broad range of post-compromise functionality, such as credential harvesting, keylogging, file manipulation, clipboard monitoring, and network tunneling.
&quot;QLNX targets developers and DevOps credentials across the software supply chain,&quot; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiholjenZRIykmReErkRiguk5xd9RV4BIEEPM0nT-o3LvMvDkCTLpd3G0NpqDGEFHp-f6QyvGRMip6CBhGlllYVlp9wS3XBVoV6xW47CDka7Ig8S_aotcuNlmAv3SYgS4hJzxjLp2nrV4SzqlTXnQLG_w68Cq0Bf5hiOoV6CaN9QZliRDa-StzsvIkJAdSF/s1600/kube.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Quasar, Linux, RAT, Steals, Developer, Credentials, for, Software, Supply, Chain, Compromise</media:keywords>
</item>

<item>
<title>Helping North Korean IT remote workers is becoming a fast track to prison</title>
<link>https://block385.com/helping-north-korean-it-remote-workers-is-becoming-a-fast-track-to-prison</link>
<guid>https://block385.com/helping-north-korean-it-remote-workers-is-becoming-a-fast-track-to-prison</guid>
<description><![CDATA[ Two U.S. nationals were sentenced to 18 months in prison for operating “laptop farms” that helped North Korean IT workers gain employment at nearly 70 American companies, generating more than $1.2 million for Pyongyang’s government. Although Matthew Issac Knoot of Nashville, Tennessee, and Erick Ntekereze Prince of New York were sentenced in separate cases, both were convicted for the same type of crime involving North Korean remote IT worker schemes. According to prosecutors, both men … More →
The post Helping North Korean IT remote workers is becoming a fast track to prison appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16065400/north_korean-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 13:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Helping, North, Korean, remote, workers, becoming, fast, track, prison</media:keywords>
</item>

<item>
<title>Google is turning Android Studio into a policy watchdog</title>
<link>https://block385.com/google-is-turning-android-studio-into-a-policy-watchdog</link>
<guid>https://block385.com/google-is-turning-android-studio-into-a-policy-watchdog</guid>
<description><![CDATA[ Google has expanded Play Policy Insights in Android Studio to help developers catch policy issues while coding, including warnings for common problems such as missing login credentials. Later this year, developers who connect their Play developer account directly to Android Studio will receive tailored insights. By leveraging SDK Index, a searchable list of Android SDKs that shows permissions, developer details, and Google Play registration status, they will also receive SDK insights in their workflows to … More →
The post Google is turning Android Studio into a policy watchdog appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/05104142/android-green-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 13:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, turning, Android, Studio, into, policy, watchdog</media:keywords>
</item>

<item>
<title>Ivanti EPMM vulnerability exploited in zero&#45;day attacks (CVE&#45;2026&#45;6973)</title>
<link>https://block385.com/ivanti-epmm-vulnerability-exploited-in-zero-day-attacks-cve-2026-6973</link>
<guid>https://block385.com/ivanti-epmm-vulnerability-exploited-in-zero-day-attacks-cve-2026-6973</guid>
<description><![CDATA[ Ivanti has released fixes for 5 high-severity vulnerabilities in its Endpoint Manager Mobile (EPMM) solution, one of which (CVE-2026-6973) has being exploited as a zero-day by attackers. “We are aware of a very limited number of customers exploited with CVE-2026-6973,” the company said in a security advisory published on Thursday. About CVE-2026-6973 CVE-2026-6973 is caused by improper input validation and allows remote attackers with administrative privileges to execute arbitrary code on vulnerable instances. “If customers … More →
The post Ivanti EPMM vulnerability exploited in zero-day attacks (CVE-2026-6973) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/09/25140514/ivanti-1-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 13:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ivanti, EPMM, vulnerability, exploited, zero-day, attacks, CVE-2026-6973</media:keywords>
</item>

<item>
<title>Product showcase: NetGuard open&#45;source firewall for Android</title>
<link>https://block385.com/product-showcase-netguard-open-source-firewall-for-android</link>
<guid>https://block385.com/product-showcase-netguard-open-source-firewall-for-android</guid>
<description><![CDATA[ NetGuard is a free, open-source firewall for Android phones and tablets that provides users with a simple way to block internet access. Android does not allow VPN services to be chained, so the app uses the Android VPN service to route all internet traffic through itself. NetGuard can be used without root access, although it also works on rooted devices. Activating NetGuard To activate the firewall, I enabled NetGuard using the switch in the action … More →
The post Product showcase: NetGuard open-source firewall for Android appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/07114959/netguard-firewall-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 11:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Product, showcase:, NetGuard, open-source, firewall, for, Android</media:keywords>
</item>

<item>
<title>Roblox chat moderation gets bypassed by leet speak and code words</title>
<link>https://block385.com/roblox-chat-moderation-gets-bypassed-by-leet-speak-and-code-words</link>
<guid>https://block385.com/roblox-chat-moderation-gets-bypassed-by-leet-speak-and-code-words</guid>
<description><![CDATA[ Roblox runs an automated chat filter at the scale of billions of messages per day. An independent audit of about two million chat messages from four of the platform’s most popular games shows that filter missing a wide range of harmful interactions, including grooming attempts, sexual content directed at minors, threats of violence, and references to self-harm. Researchers from the University of Arizona and Arizona State University collected the messages from public servers covering the … More →
The post Roblox chat moderation gets bypassed by leet speak and code words appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/07133726/roblox-1200.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 11:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Roblox, chat, moderation, gets, bypassed, leet, speak, and, code, words</media:keywords>
</item>

<item>
<title>Mental health apps are collecting more than emotional conversations</title>
<link>https://block385.com/mental-health-apps-are-collecting-more-than-emotional-conversations</link>
<guid>https://block385.com/mental-health-apps-are-collecting-more-than-emotional-conversations</guid>
<description><![CDATA[ People use mental health apps to talk about depression, trauma and suicidal thoughts in moments they may not share with anyone else. Many users likely assume those conversations carry protections similar to therapy sessions. In reality, mental health apps operate without the same confidentiality and privacy standards that govern licensed therapists. A new academic study examining 25 popular Android mental health and therapy apps found that every app contained at least one undisclosed tracker absent … More →
The post Mental health apps are collecting more than emotional conversations appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/05/24165903/mental_health.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 11:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mental, health, apps, are, collecting, more, than, emotional, conversations</media:keywords>
</item>

<item>
<title>May 2026 Patch Tuesday forecast: AI starts driving security industry changes</title>
<link>https://block385.com/may-2026-patch-tuesday-forecast-ai-starts-driving-security-industry-changes</link>
<guid>https://block385.com/may-2026-patch-tuesday-forecast-ai-starts-driving-security-industry-changes</guid>
<description><![CDATA[ Project Glasswing. This is one of three major security industry changes I’ll cover today. The Anthropic Mythos vulnerability discovery model has already proven to be game changing in its ability to identify new vulnerabilities in software. Many of these vulnerabilities have existed for 10 to 15 years without human discovery. In a recent announcement from Mozilla, they discovered 271 vulnerabilities when running it against Firefox 150 prior to release. This sheer volume of new vulnerabilities … More →
The post May 2026 Patch Tuesday forecast: AI starts driving security industry changes appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/05/14201550/patch_tuesday_news1.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 11:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>May, 2026, Patch, Tuesday, forecast:, starts, driving, security, industry, changes</media:keywords>
</item>

<item>
<title>Transilience AI unveils Security Operating System for cloud remediation</title>
<link>https://block385.com/transilience-ai-unveils-security-operating-system-for-cloud-remediation</link>
<guid>https://block385.com/transilience-ai-unveils-security-operating-system-for-cloud-remediation</guid>
<description><![CDATA[ Transilience AI has announced the general availability of its Full Stack Security Operating System for the cloud, platform designed to solve one of enterprise security’s most persistent challenges: bridging the gap between detection and remediation. New platform replaces fragmented tool sprawl with an agent-powered, human-guided second brain, moving security posture from Detected to Eliminated. Cloud security teams are overwhelmed by a fragmented ecosystem of CSPM, CTEM, CNAPP, and CWPP tools. Each generates signals, but effective … More →
The post Transilience AI unveils Security Operating System for cloud remediation appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 11:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Transilience, unveils, Security, Operating, System, for, cloud, remediation</media:keywords>
</item>

<item>
<title>Object First Fleet Manager simplifies distributed backup storage</title>
<link>https://block385.com/object-first-fleet-manager-simplifies-distributed-backup-storage</link>
<guid>https://block385.com/object-first-fleet-manager-simplifies-distributed-backup-storage</guid>
<description><![CDATA[ Object First released Object First Fleet Manager, a cloud-based service that simplifies the management of distributed Ootbi backup storage deployments for Veeam Software environments. Built for enterprises and service providers with distributed backup storage infrastructures, Fleet Manager is available to Ootbi users with active support contracts at no additional cost. As backup infrastructure becomes more complex, managing multiple locations, data centers, and clients creates significant operational overhead. According to Enterprise Strategy Group research, 96% of … More →
The post Object First Fleet Manager simplifies distributed backup storage appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 11:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Object, First, Fleet, Manager, simplifies, distributed, backup, storage</media:keywords>
</item>

<item>
<title>OpenAI tunes GPT&#45;5.5&#45;Cyber for more permissive security workflows</title>
<link>https://block385.com/openai-tunes-gpt-55-cyber-for-more-permissive-security-workflows</link>
<guid>https://block385.com/openai-tunes-gpt-55-cyber-for-more-permissive-security-workflows</guid>
<description><![CDATA[ OpenAI is rolling out GPT-5.5-Cyber, a variant of its latest AI model, in limited preview for verified cybersecurity professionals and organizations through its Trusted Access for Cyber program. Trusted Access for Cyber is OpenAI’s identity and trust-based access framework for cybersecurity users, designed to give verified defenders broader access to GPT-5.5’s cybersecurity capabilities for defensive tasks while maintaining restrictions on requests that could contribute to real-world harm. ChatGPT 5.5 was released two weeks ago as … More →
The post OpenAI tunes GPT-5.5-Cyber for more permissive security workflows appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/03102604/openai-lock-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 11:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI, tunes, GPT-5.5-Cyber, for, more, permissive, security, workflows</media:keywords>
</item>

<item>
<title>Avantra’s new AI can diagnose SAP failures in seconds</title>
<link>https://block385.com/avantras-new-ai-can-diagnose-sap-failures-in-seconds</link>
<guid>https://block385.com/avantras-new-ai-can-diagnose-sap-failures-in-seconds</guid>
<description><![CDATA[ Avantra launched Avantra 26, an advancement in AI-driven operations, strengthening native integration with SAP Cloud ALM, and delivering automated visibility across SAP Business Technology Platform (BTP). Avantra also announced Avantra AIR Root Cause Analyzer, an AI-powered intelligence engine that automatically investigates SAP incidents and surfaces a structured diagnosis the moment an issue is detected. Available as a separate license, Avantra AIR uses AI to correlate logs, system data, and alerts across multiple systems manually. “SAP … More →
The post Avantra’s new AI can diagnose SAP failures in seconds appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 11:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Avantra’s, new, can, diagnose, SAP, failures, seconds</media:keywords>
</item>

<item>
<title>Securonix launches AI threat research agent and ThreatWatch validation tool</title>
<link>https://block385.com/securonix-launches-ai-threat-research-agent-and-threatwatch-validation-tool</link>
<guid>https://block385.com/securonix-launches-ai-threat-research-agent-and-threatwatch-validation-tool</guid>
<description><![CDATA[ Securonix announced the Securonix Threat Research Agent and ThreatWatch for ThreatQ, expanding how security teams research threats, validate exposure, and turn intelligence into documented action. Built on the ThreatQ platform and connected to Securonix security operations workflows, the new capabilities help teams generate role-specific intelligence, validate emerging threats against historical telemetry, and deliver explainable findings for analysts, SOC leaders, and executives. Security teams are under growing pressure to explain what is happening, why it matters, … More →
The post Securonix launches AI threat research agent and ThreatWatch validation tool appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 11:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Securonix, launches, threat, research, agent, and, ThreatWatch, validation, tool</media:keywords>
</item>

<item>
<title>Snyk integrates Claude to advance AI&#45;native application security</title>
<link>https://block385.com/snyk-integrates-claude-to-advance-ai-native-application-security</link>
<guid>https://block385.com/snyk-integrates-claude-to-advance-ai-native-application-security</guid>
<description><![CDATA[ Snyk has announced it is leveraging Anthropic’s Claude models to advance software security. Snyk has integrated Claude into the Snyk AI Security Platform, enabling automated vulnerability discovery, prioritization, and developer-ready fixes across code, dependencies, containers, and AI-generated artifacts. The threat driving that integration is real and accelerating. It’s a challenge that JPMorganChase’s Global Technology Leadership Team named in April 2026 as one of the most critical actions enterprises must take now, embedding security directly into … More →
The post Snyk integrates Claude to advance AI-native application security appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 11:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Snyk, integrates, Claude, advance, AI-native, application, security</media:keywords>
</item>

<item>
<title>Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions</title>
<link>https://block385.com/linux-kernel-dirty-frag-lpe-exploit-enables-root-access-across-major-distributions</link>
<guid>https://block385.com/linux-kernel-dirty-frag-lpe-exploit-enables-root-access-across-major-distributions</guid>
<description><![CDATA[ Details have emerged about a new, unpatched local privilege escalation (LPE) vulnerability impacting the Linux kernel.
Dubbed Dirty Frag, it has been described as a successor to Copy Fail (CVE-2026-31431, CVSS score: 7.8), a recently disclosed LPE flaw impacting the Linux kernel that has since come under active exploitation in the wild. The vulnerability was reported to Linux kernel maintainers ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnVSDBWt4hKZ-DOrZqHWPVH0JxrpcUeup9hpMpoH5Ny8bpuJ6Lviv58aH0aK2S2IJvAugaYRhM8P9wUW3tbVCu2kFMQbG5F16kI3PvS6gmR2Px8qOxcat-tK-UHV9oSDsAv9MHjvrduyndsqhicJxX1GroDTBo8it4ANI2wKIUVauhdxbgrNBQHhdgq2SW/s1600/linux.gif" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 10:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Linux, Kernel, Dirty, Frag, LPE, Exploit, Enables, Root, Access, Across, Major, Distributions</media:keywords>
</item>

<item>
<title>New infosec products of the week: May 8, 2026</title>
<link>https://block385.com/new-infosec-products-of-the-week-may-8-2026</link>
<guid>https://block385.com/new-infosec-products-of-the-week-may-8-2026</guid>
<description><![CDATA[ Here’s a look at the most interesting products from the past week LastPass, Operant AI, Sysdig, and VIAVI. Operant AI Endpoint Protector secures AI agents and MCP tools Operant AI has launched Operant Endpoint Protector, a new addition to its AI Defense Platform that enables enterprise IT and security teams to discover, detect, and defend against threats across every AI tool, coding agent, and Model Context Protocol (MCP)-connected workflow used by employees, directly at the … More →
The post New infosec products of the week: May 8, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/28091843/infosec-week-1200.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 07:00:23 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, infosec, products, the, week:, May, 2026</media:keywords>
</item>

<item>
<title>Your coworker might be selling company logins, and thinks it’s fine</title>
<link>https://block385.com/your-coworker-might-be-selling-company-logins-and-thinks-its-fine</link>
<guid>https://block385.com/your-coworker-might-be-selling-company-logins-and-thinks-its-fine</guid>
<description><![CDATA[ Employee behavior once considered unacceptable is becoming tolerated across various industries, particularly in IT and telecommunications, and at all levels of seniority, including leadership. Cifas Workplace Fraud Trends research, based on a survey of 2,000 UK employees working at companies with more than 1,000 staff, shows that employee-driven fraud, such as selling login credentials or secretly working for competitors, is being viewed as justifiable. “These findings reflect a broader shift in workplace behaviors when faced … More →
The post Your coworker might be selling company logins, and thinks it’s fine appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/25153040/fraud-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 07:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Your, coworker, might, selling, company, logins, and, thinks, it’s, fine</media:keywords>
</item>

<item>
<title>After Replacing TeamPCP Malware, &amp;apos;PCPJack&amp;apos; Steals Cloud Secrets</title>
<link>https://block385.com/after-replacing-teampcp-malware-pcpjack-steals-cloud-secrets</link>
<guid>https://block385.com/after-replacing-teampcp-malware-pcpjack-steals-cloud-secrets</guid>
<description><![CDATA[ PCPJack makes innovative use of parquet files for stealthy, pre-validated target discovery as it canvasses multiple cloud environments. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt7d42ab7db3a9305d/69fced373a447bc0eea0e5a0/Outlaw_duel-North_Wind_Picture_Archives-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 08 May 2026 01:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>After, Replacing, TeamPCP, Malware, PCPJack, Steals, Cloud, Secrets</media:keywords>
</item>

<item>
<title>Red Hat Enterprise Linux adds post&#45;quantum security and AI&#45;driven automation in latest releases</title>
<link>https://block385.com/red-hat-enterprise-linux-adds-post-quantum-security-and-ai-driven-automation-in-latest-releases</link>
<guid>https://block385.com/red-hat-enterprise-linux-adds-post-quantum-security-and-ai-driven-automation-in-latest-releases</guid>
<description><![CDATA[ Red Hat has announced the upcoming general availability of Red Hat Enterprise Linux 10.2 and 9.8. Building on the innovation of Red Hat Enterprise Linux 10, the latest versions help address security threats, speed AI innovation and minimize operational drift. What Red Hat announced Red Hat Enterprise Linux 10.2 and 9.8 provide a strategic and durable operating system (OS) platform that unifies IT operations across the hybrid cloud with security in mind. By enhancing confidential … More →
The post Red Hat Enterprise Linux adds post-quantum security and AI-driven automation in latest releases appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 23:01:14 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Red, Hat, Enterprise, Linux, adds, post-quantum, security, and, AI-driven, automation, latest, releases</media:keywords>
</item>

<item>
<title>Kloudfuse 4.0 delivers AI&#45;governed observability and scalable workload isolation</title>
<link>https://block385.com/kloudfuse-40-delivers-ai-governed-observability-and-scalable-workload-isolation</link>
<guid>https://block385.com/kloudfuse-40-delivers-ai-governed-observability-and-scalable-workload-isolation</guid>
<description><![CDATA[ Kloudfuse has announced the general availability of Kloudfuse 4.0. The release helps enterprises meet rising compliance requirements, adopt AI-driven observability with production-grade governance, and scale their observability infrastructure without platform bottlenecks, while keeping every byte of telemetry data inside their own cloud environment. Kloudfuse 4.0 addresses three converging pressures: the FIPS 140-2 sunset on September 22, 2026, after which NIST will move all FIPS 140-2 certificates to the Historical List, the enterprise adoption of AI … More →
The post Kloudfuse 4.0 delivers AI-governed observability and scalable workload isolation appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 23:01:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Kloudfuse, 4.0, delivers, AI-governed, observability, and, scalable, workload, isolation</media:keywords>
</item>

<item>
<title>CallPhantom Android scam reached 7.3 million downloads on Google Play</title>
<link>https://block385.com/callphantom-android-scam-reached-73-million-downloads-on-google-play</link>
<guid>https://block385.com/callphantom-android-scam-reached-73-million-downloads-on-google-play</guid>
<description><![CDATA[ Scams targeting Android users in India and across the Asia-Pacific region have grown around a long-standing curiosity gap: the desire to look up call records tied to a phone number. A cluster of 28 fraudulent apps on Google Play exploited that gap and pulled in more than 7.3 million downloads before the store removed them. ESET researchers, who tracked the campaign and named it CallPhantom, reported the apps to Google on December 16, 2025, and … More →
The post CallPhantom Android scam reached 7.3 million downloads on Google Play appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/06122653/callphantom-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 23:01:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CallPhantom, Android, scam, reached, 7.3, million, downloads, Google, Play</media:keywords>
</item>

<item>
<title>Facial recognition arrives at the gates of Disney’s magic kingdom</title>
<link>https://block385.com/facial-recognition-arrives-at-the-gates-of-disneys-magic-kingdom</link>
<guid>https://block385.com/facial-recognition-arrives-at-the-gates-of-disneys-magic-kingdom</guid>
<description><![CDATA[ Disney has equipped select entrance lanes at Disneyland Park and Disney California Adventure Park with facial recognition technology, saying the system is intended to streamline re-entry procedures and help prevent fraud. According to the company, certain entrance lanes use cameras to capture an image linked to a guest’s ticket or pass and compare it with a newly taken image at the entrance. The system then converts both images into unique numerical values using biometric technology … More →
The post Facial recognition arrives at the gates of Disney’s magic kingdom appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/04135518/surveillance-eye-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 23:01:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Facial, recognition, arrives, the, gates, Disney’s, magic, kingdom</media:keywords>
</item>

<item>
<title>Node.js 26 ships with Temporal API enabled by default</title>
<link>https://block385.com/nodejs-26-ships-with-temporal-api-enabled-by-default</link>
<guid>https://block385.com/nodejs-26-ships-with-temporal-api-enabled-by-default</guid>
<description><![CDATA[ Developers managing JavaScript runtimes have a new major version to evaluate. Node.js 26.0.0 brings the long-awaited Temporal API to the platform alongside an updated V8 engine, a refreshed HTTP client, and several long-flagged removals that will require code changes in some applications. Temporal API ready for production code Temporal, a date and time API designed to replace the aging Date object, is now available in Node.js without an experimental flag. The API offers richer handling … More →
The post Node.js 26 ships with Temporal API enabled by default appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/07112113/nodejs-logo-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 23:01:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Node.js, ships, with, Temporal, API, enabled, default</media:keywords>
</item>

<item>
<title>State&#45;sponsored hackers likely behind zero&#45;day attacks on Palo Alto firewalls</title>
<link>https://block385.com/state-sponsored-hackers-likely-behind-zero-day-attacks-on-palo-alto-firewalls</link>
<guid>https://block385.com/state-sponsored-hackers-likely-behind-zero-day-attacks-on-palo-alto-firewalls</guid>
<description><![CDATA[ Palo Alto Networks believes the in-the-wild exploitation of a zero-day vulnerability (CVE-2026-0300) in its firewalls is likely the work of state-sponsored threat actors. A flaw with no patch (yet) CVE-2026-0300 is a buffer overflow vulnerability in the User-ID Authentication Portal service of Palo Alto Networks PAN-OS software, and can be exploited by unauthenticated attackers sending specially crafted packets to internet-facing User-ID Authentication Portals. The flaw affects Palo Alto Networks’ PA-Series and VM-Series firewalls, and the … More →
The post State-sponsored hackers likely behind zero-day attacks on Palo Alto firewalls appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/04/17164810/palo_alto_networks-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 23:00:58 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>State-sponsored, hackers, likely, behind, zero-day, attacks, Palo, Alto, firewalls</media:keywords>
</item>

<item>
<title>One keypress is all it takes to compromise four AI coding tools</title>
<link>https://block385.com/one-keypress-is-all-it-takes-to-compromise-four-ai-coding-tools</link>
<guid>https://block385.com/one-keypress-is-all-it-takes-to-compromise-four-ai-coding-tools</guid>
<description><![CDATA[ Developers clone unfamiliar repositories all the time. Open-source projects, work from teammates, sample code from a tutorial, a library someone recommended on a forum. The convention is old and reasonable: you look at what’s inside before you run it. AI coding assistants that work from the command line have inherited that convention, and a new piece of research from Adversa AI shows where the convention breaks. The research, called TrustFall, covers four agentic coding tools: … More →
The post One keypress is all it takes to compromise four AI coding tools appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/06142536/click-button-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 23:00:52 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>One, keypress, all, takes, compromise, four, coding, tools</media:keywords>
</item>

<item>
<title>$250 million cryptocurrency heist funded luxury fashion, nightclub parties, and private jets</title>
<link>https://block385.com/250-million-cryptocurrency-heist-funded-luxury-fashion-nightclub-parties-and-private-jets</link>
<guid>https://block385.com/250-million-cryptocurrency-heist-funded-luxury-fashion-nightclub-parties-and-private-jets</guid>
<description><![CDATA[ 20-year-old California resident Marlon Ferro, known online as “GothFerrari,” was sentenced to 78 months in prison for his role in a cryptocurrency theft operation tied to more than $250 million in stolen digital assets. Federal prosecutors said Ferro participated in a criminal network active between late 2023 and early 2025. Members of the group, based in California, Connecticut, New York, Florida, and overseas, carried out roles that included database hacking, target identification, fraudulent phone calls, … More →
The post $250 million cryptocurrency heist funded luxury fashion, nightclub parties, and private jets appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 23:00:22 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>250, million, cryptocurrency, heist, funded, luxury, fashion, nightclub, parties, and, private, jets</media:keywords>
</item>

<item>
<title>What Mozilla learned running an AI security bug hunting pipeline on Firefox</title>
<link>https://block385.com/what-mozilla-learned-running-an-ai-security-bug-hunting-pipeline-on-firefox</link>
<guid>https://block385.com/what-mozilla-learned-running-an-ai-security-bug-hunting-pipeline-on-firefox</guid>
<description><![CDATA[ Over the past several months, Mozilla ran an agentic harness powered by Claude Mythos Preview across Firefox’s source code, identifying 271 security bugs that were fixed in Firefox 150, with additional fixes shipped in versions 149.0.2 and 150.0.1. Over 100 people contributed code to get those patches out. The bugs spanned a wide range of subsystems. Among the disclosed reports: a 15-year-old flaw in the HTML  element, a 20-year-old XSLT bug involving reentrant key() … More →
The post What Mozilla learned running an AI security bug hunting pipeline on Firefox appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/07073721/claude-firefox-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 23:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>What, Mozilla, learned, running, security, bug, hunting, pipeline, Firefox</media:keywords>
</item>

<item>
<title>Ivanti EPMM CVE&#45;2026&#45;6973 RCE Under Active Exploitation Grants Admin&#45;Level Access</title>
<link>https://block385.com/ivanti-epmm-cve-2026-6973-rce-under-active-exploitation-grants-admin-level-access</link>
<guid>https://block385.com/ivanti-epmm-cve-2026-6973-rce-under-active-exploitation-grants-admin-level-access</guid>
<description><![CDATA[ Ivanti is warning that a new security flaw impacting Endpoint Manager Mobile (EPMM) has been explored in limited attacks in the wild.
The high-severity vulnerability, CVE-2026-6973 (CVSS score: 7.2), is a case of improper input validation affecting EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1.
It allows &quot;a remotely authenticated user with administrative access to achieve remote code ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiX-v9Rdn-UppGqdbm0oFYXNg6myRCPn8r-d4BXVN0e2r2hqrYbGPUwOKafMbwKlojjbck4C8Ez6dxZ7WcLF45PNphvCo1K4OGhXl0u9fWanVMbO62iZoWMQJrplTa6VaXfI2rhQL40PoDK0ZNh2jqDJGBc9LylbIE92LWSNEIkVUhSpkGyAfV7g-DVZlU1/s1600/ivanti.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 20:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ivanti, EPMM, CVE-2026-6973, RCE, Under, Active, Exploitation, Grants, Admin-Level, Access</media:keywords>
</item>

<item>
<title>PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm&#45;Like Across Cloud Systems</title>
<link>https://block385.com/pcpjack-credential-stealer-exploits-5-cves-to-spread-worm-like-across-cloud-systems</link>
<guid>https://block385.com/pcpjack-credential-stealer-exploits-5-cves-to-spread-worm-like-across-cloud-systems</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a new credential theft framework dubbed PCPJack that targets exposed cloud infrastructure and ousts any artifacts linked to TeamPCP from the environments.
&quot;The toolset harvests credentials from cloud, container, developer, productivity, and financial services, then exfiltrates the data through attacker-controlled infrastructure while attempting ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2N74T5rZvfRcHqUhwtyI3hbxAAQnB-RQQqpiGSIJqdplaQaZcjvqLR80d3pIjwJyGtAO5V0Ji6_3w4V4Ww901x4aSGY_Id3lzqXNdGUMbprz80zXoKzHVoIBqyhVBU_LvIMyJHV5MHaMWvZuWgREFmqG4jOdBLpW4gBtgKCrnfRS4mIXemDQ9U_fRERQf/s1600/clouds.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 20:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>PCPJack, Credential, Stealer, Exploits, CVEs, Spread, Worm-Like, Across, Cloud, Systems</media:keywords>
</item>

<item>
<title>Has CISA Finally Found Its New Leader in Tom Parker?</title>
<link>https://block385.com/has-cisa-finally-found-its-new-leader-in-tom-parker</link>
<guid>https://block385.com/has-cisa-finally-found-its-new-leader-in-tom-parker</guid>
<description><![CDATA[ Dark Reading investigates rumors that Tom Parker, a board room &#039;operator&#039; and longtime cyber exec, could be next in line to take over CISA. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd78672b4ab1bba5b/69fbad02074d2d799822412b/CISA_Timon_Schneider_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 19:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Has, CISA, Finally, Found, Its, New, Leader, Tom, Parker</media:keywords>
</item>

<item>
<title>&amp;apos;TrustFall&amp;apos; Convention Exposes Claude Code Execution Risk</title>
<link>https://block385.com/trustfall-convention-exposes-claude-code-execution-risk</link>
<guid>https://block385.com/trustfall-convention-exposes-claude-code-execution-risk</guid>
<description><![CDATA[ Malicious repositories can trigger code execution in Claude Code, Cursor CLI, Gemini CLI, and CoPilot CLI with minimal or no user interaction, thanks to skimpy warning dialogs. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3ca377db822451a1/69fa57f81032fe21f456f521/claude_Samuel_Boivin_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 17:00:01 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TrustFall, Convention, Exposes, Claude, Code, Execution, Risk</media:keywords>
</item>

<item>
<title>World&amp;apos;s First AI&#45;Driven Cyberattack Couldn&amp;apos;t Breach OT Systems</title>
<link>https://block385.com/worlds-first-ai-driven-cyberattack-couldnt-breach-ot-systems</link>
<guid>https://block385.com/worlds-first-ai-driven-cyberattack-couldnt-breach-ot-systems</guid>
<description><![CDATA[ The most sophisticated AI-integrated campaign to date hit a brick wall in the form of a SCADA login screen. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt98fa61979c1de1b0/69fb95aa4f86c99808c8fc96/Faucet-Steven_Liveoak-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 17:00:01 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Worlds, First, AI-Driven, Cyberattack, Couldnt, Breach, Systems</media:keywords>
</item>

<item>
<title>One Click, Total Shutdown: The &amp;quot;Patient Zero&amp;quot; Webinar on Killing Stealth Breaches</title>
<link>https://block385.com/one-click-total-shutdown-the-patient-zero-webinar-on-killing-stealth-breaches</link>
<guid>https://block385.com/one-click-total-shutdown-the-patient-zero-webinar-on-killing-stealth-breaches</guid>
<description><![CDATA[ The hardest part of cybersecurity isn&#039;t the technology, it’s the people.
Every major breach you’ve read about lately usually starts the same way: one employee, one clever email, and one &quot;Patient Zero&quot; infection.
In 2026, hackers are using AI to make these &quot;first clicks&quot; nearly impossible to spot. If a single laptop gets compromised on your watch, do you have a plan to stop it from taking down ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhz_1BMhUux9JB2X26ToAMnW32GttimEIwRX1fG4_LrlZjedjkjzps_Ad-eiSX-2LlJ1FFIw3g1kvH1kKrgwETmSgTk8wal5a7AJQNIY2IH3317GaUYEj-_3tko2hxjKBc1ms0WQ7UjHHTst0aKtjFz1jOPasyD8x5U_GQW4KdhKxDPHhlmYVOY9TM6vLy_/s1600/zz-webinar.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 16:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>One, Click, Total, Shutdown:, The, Patient, Zero, Webinar, Killing, Stealth, Breaches</media:keywords>
</item>

<item>
<title>PAN&#45;OS RCE Exploit Under Active Use Enabling Root Access and Espionage</title>
<link>https://block385.com/pan-os-rce-exploit-under-active-use-enabling-root-access-and-espionage</link>
<guid>https://block385.com/pan-os-rce-exploit-under-active-use-enabling-root-access-and-espionage</guid>
<description><![CDATA[ Palo Alto Networks has disclosed that threat actors may have attempted to unsuccessfully exploit a recently disclosed critical security flaw as early as April 9, 2026.
The vulnerability in question is CVE-2026-0300 (CVSS score: 9.3/8.7), a buffer overflow vulnerability in the User-ID Authentication Portal service of Palo Alto Networks PAN-OS software that could allow an unauthenticated attacker ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhA-FbTXMB7fJu_4ZxIlvKU2wHShSiMZaCQBah-p33256FjWEUsO0kd4s-LXOT_YQoS39Mj5f7nhj-ERtNF2EPNU9WG91ZWJXpl4cwYFoWz8npaMpVWzAhYjVVB-JnPyoycvPmik7Y5IsihIDXp7_mHvh4DYUz9vqkkVRYgylDqKeezcDEwqRJNs4F_2scA/s1600/paloalto-rce.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 16:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>PAN-OS, RCE, Exploit, Under, Active, Use, Enabling, Root, Access, and, Espionage</media:keywords>
</item>

<item>
<title>ThreatsDay Bulletin: Edge Plaintext Passwords, ICS 0&#45;Days, Patch&#45;or&#45;Die Alerts and 25+ New Stories</title>
<link>https://block385.com/threatsday-bulletin-edge-plaintext-passwords-ics-0-days-patch-or-die-alerts-and-25-new-stories</link>
<guid>https://block385.com/threatsday-bulletin-edge-plaintext-passwords-ics-0-days-patch-or-die-alerts-and-25-new-stories</guid>
<description><![CDATA[ Bad week.
Turns out the easiest way to get hacked in 2026 is still the same old garbage: shady packages, fake apps, forgotten DNS junk, scam ads, and stolen logins getting dumped into Discord channels like it’s normal. Some of these attack chains don’t even feel sophisticated anymore. More like some tired guy with a Telegram account and too much free time. The worst part is how often this stuff ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYNaH2vOiD-OgAVnO0nGCSr8j4nnvHD2n7RieJD2mDMlPev_fKoBafjhvob13LV4pOFhgMuZd6ex8zyQnCM1AyVfl6fuRG9Max2F76Ku9rWbieBvF0AtGlQd0nXlIwHDKvq5H4BJn3hGCRfE86fHs5SL05RywOADNDC9J5lG9DF8goavgxWzAh7a7isNMB/s1600/threatsday-1.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 14:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ThreatsDay, Bulletin:, Edge, Plaintext, Passwords, ICS, 0-Days, Patch-or-Die, Alerts, and, 25, New, Stories</media:keywords>
</item>

<item>
<title>Day Zero Readiness: The Operational Gaps That Break Incident Response</title>
<link>https://block385.com/day-zero-readiness-the-operational-gaps-that-break-incident-response</link>
<guid>https://block385.com/day-zero-readiness-the-operational-gaps-that-break-incident-response</guid>
<description><![CDATA[ Having an incident response retainer, or even a pre-approved external incident response firm, is not the same as being ready for an incident. A retainer means someone will answer the phone. Operational readiness determines whether that team can do meaningful work the moment they do. 
That distinction matters far more than many organizations realize. In the first hours of a security incident ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdEBtnOnAfYEV-De3NPPeeTCPWK_gSqYM7OZ0ioRJl84OvS49Fp-GJucJfc-ADDOhyTe11dUoYbkIlA1gYW5b8E6KxYIG71gNa0pU4tmqiEyfmxAEyI1A3n2ZOzfePdcm5WdqHVnFlrSwzgNlOmWKMUOHTqUjS_qUhHBEI9CpMJ_OZrUgn-yaHjTDaXJ0/s1600/main.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 14:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Day, Zero, Readiness:, The, Operational, Gaps, That, Break, Incident, Response</media:keywords>
</item>

<item>
<title>PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux</title>
<link>https://block385.com/pypi-packages-deliver-zichatbot-malware-via-zulip-apis-on-windows-and-linux</link>
<guid>https://block385.com/pypi-packages-deliver-zichatbot-malware-via-zulip-apis-on-windows-and-linux</guid>
<description><![CDATA[ Cybersecurity researchers have discovered three packages on the Python Package Index (PyPI) repository that are designed to stealthily deliver a previously unknown malware family called ZiChatBot on Windows and Linux systems.
&quot;While these wheel packages do implement the features described on their PyPI web pages, their true purpose is to covertly deliver malicious files,&quot; Kaspersky  ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGun7lMQJXWH3IQiR3ml3RMzAbb1QJcWEtgqDrKTjPbvBhTsDPaCWmI1vTAnevTVPx0lg4xvPkOcpx_86_Znxdgpj-hynQXGEHqf94dvYwOy5VqqnqBWEWrJ3MEkQcLVBVt00Y8pUqVWj4W-hYYepmDmtX9PRQh87qZC7XbJCwdEaLsBY-vTsbkS0yqikd/s1600/pypi.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 12:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>PyPI, Packages, Deliver, ZiChatBot, Malware, via, Zulip, APIs, Windows, and, Linux</media:keywords>
</item>

<item>
<title>Attackers compromised Daemon Tools software to deliver backdoors</title>
<link>https://block385.com/attackers-compromised-daemon-tools-software-to-deliver-backdoors</link>
<guid>https://block385.com/attackers-compromised-daemon-tools-software-to-deliver-backdoors</guid>
<description><![CDATA[ Kaspersky researchers uncovered another supply chain compromise involving a popular Windows tool: Daemon Tools, an app for mounting disk image files as virtual drives that is widely used by gamers, developers, and IT professionals. Since April 8, 2026, the official Daemon Tools download site (at Deamon-tools[.]cc) was serving signed, trojanized Windows installers. Once installed, these compromised binaries would silently reach out to an attacker-controlled server to download a .NET-based information collector, harvesting system details such … More →
The post Attackers compromised Daemon Tools software to deliver backdoors appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/06084922/malware-website.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 09:00:56 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Attackers, compromised, Daemon, Tools, software, deliver, backdoors</media:keywords>
</item>

<item>
<title>Sysdig delivers cloud security that runs inside AI coding agents</title>
<link>https://block385.com/sysdig-delivers-cloud-security-that-runs-inside-ai-coding-agents</link>
<guid>https://block385.com/sysdig-delivers-cloud-security-that-runs-inside-ai-coding-agents</guid>
<description><![CDATA[ Sysdig announced headless cloud security, a cyberdefense platform designed for the agentic AI era. Sysdig Headless Cloud Security enables customers to drop the traditional, one-size-fits-all UI approach and equip their AI agents as the primary operators of machine-speed, data-driven cyberdefense. Over the last year, rapid advancements across coding agents such as Claude Code, Codex, and Cursor have driven a surge in user adoption. These intelligent, automated workflows have redefined both the way people work and … More →
The post Sysdig delivers cloud security that runs inside AI coding agents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 09:00:45 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Sysdig, delivers, cloud, security, that, runs, inside, coding, agents</media:keywords>
</item>

<item>
<title>Teams calls are about to get a lot harder to fake</title>
<link>https://block385.com/teams-calls-are-about-to-get-a-lot-harder-to-fake</link>
<guid>https://block385.com/teams-calls-are-about-to-get-a-lot-harder-to-fake</guid>
<description><![CDATA[ Microsoft Teams Calling is getting a new feature that will warn users about suspicious inbound VoIP calls from first-time external callers who might be impersonating trusted brands.
The post Teams calls are about to get a lot harder to fake appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/17114130/ms-teams-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 09:00:26 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Teams, calls, are, about, get, lot, harder, fake</media:keywords>
</item>

<item>
<title>Multi&#45;model AI is creating a routing headache for enterprises</title>
<link>https://block385.com/multi-model-ai-is-creating-a-routing-headache-for-enterprises</link>
<guid>https://block385.com/multi-model-ai-is-creating-a-routing-headache-for-enterprises</guid>
<description><![CDATA[ Application teams are moving AI inference into production systems that support business operations. Enterprises are expanding traffic management, identity controls, observability, and routing systems for multiple AI models and environments. F5’s 2026 State of Application Strategy Report found that 78% of organizations operate their own inference services and 77% identify inference as their primary AI activity. They also operate or evaluate an average of seven AI models. AI inference is the process of using a … More →
The post Multi-model AI is creating a routing headache for enterprises appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/27085031/ai-evolution-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 09:00:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Multi-model, creating, routing, headache, for, enterprises</media:keywords>
</item>

<item>
<title>Open&#45;source MCP server monitoring for Python apps</title>
<link>https://block385.com/open-source-mcp-server-monitoring-for-python-apps</link>
<guid>https://block385.com/open-source-mcp-server-monitoring-for-python-apps</guid>
<description><![CDATA[ Pythonic Model Context Protocol servers handle tool calls, session events, module imports, and subprocess activity. BlueRock has released MCP Python Hooks, an open source runtime sensor that gives developers a way to capture those signals without modifying application code. What the sensor captures The tool wraps a Python process at startup so its hooks initialize before application code executes. According to BlueRock CEO Harold Byun, this is achieved through Python-native mechanisms: audit hooks for security-sensitive … More →
The post Open-source MCP server monitoring for Python apps appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/06054954/python-mcp.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 09:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Open-source, MCP, server, monitoring, for, Python, apps</media:keywords>
</item>

<item>
<title>vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution</title>
<link>https://block385.com/vm2-nodejs-library-vulnerabilities-enable-sandbox-escape-and-arbitrary-code-execution</link>
<guid>https://block385.com/vm2-nodejs-library-vulnerabilities-enable-sandbox-escape-and-arbitrary-code-execution</guid>
<description><![CDATA[ A dozen critical security vulnerabilities have been disclosed in the vm2 Node.js library that could be exploited by bad actors to break out of the sandbox and execute arbitrary code on susceptible systems.
vm2 is an open-source library used to run untrusted JavaScript code inside a secure sandbox by intercepting and proxying JavaScript objects to prevent sandboxed code from accessing the host ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGJE3Tcr425AIfztOUrdhPUiEkVY8bMrHMmO-5FZ2N3cLaW9ErdLJJS3KwjzYNvLAIcVT7xpSw8wswiDIPenyZa_ki3ZrOHJFY-cXKHPu0EGnfCGXxkEAlvE6tLogT8T_lRolQ-qI-GFqlgwqpbLD1HfmDo4HkJbV9XNDh9rcGbM3Nc8ruu5I_47DBmzsy/s1600/vm2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 08:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>vm2, Node.js, Library, Vulnerabilities, Enable, Sandbox, Escape, and, Arbitrary, Code, Execution</media:keywords>
</item>

<item>
<title>Instructure Breach Exposes Schools&amp;apos; Vendor Dependence</title>
<link>https://block385.com/instructure-breach-exposes-schools-vendor-dependence</link>
<guid>https://block385.com/instructure-breach-exposes-schools-vendor-dependence</guid>
<description><![CDATA[ ShinyHunters&#039; attack on Instructure, which owns the widely used Canvas learning management system (LMS), carries big questions about the trust educational institutions put into their vendors. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc313eec07f19bb91/69fb990fce7a03313d4341a4/Instructure_Timon_Schneider_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 01:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Instructure, Breach, Exposes, Schools, Vendor, Dependence</media:keywords>
</item>

<item>
<title>Yet Another Way to Bypass Google Chrome&amp;apos;s Encryption Protection</title>
<link>https://block385.com/yet-another-way-to-bypass-google-chromes-encryption-protection</link>
<guid>https://block385.com/yet-another-way-to-bypass-google-chromes-encryption-protection</guid>
<description><![CDATA[ Authors of the VoidStealer Trojan uncovered a way to get around Google&#039;s App-Bound Encryption (ABE), opening the door to infostealers. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0b9267d0fd783b29/69fba7aa14132e45944be6c4/cookies_izzuanroslan_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 01:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Yet, Another, Way, Bypass, Google, Chromes, Encryption, Protection</media:keywords>
</item>

<item>
<title>Mirai&#45;Based xlabs_v1 Botnet Exploits ADB to Hijack IoT Devices for DDoS Attacks</title>
<link>https://block385.com/mirai-based-xlabs_v1-botnet-exploits-adb-to-hijack-iot-devices-for-ddos-attacks</link>
<guid>https://block385.com/mirai-based-xlabs_v1-botnet-exploits-adb-to-hijack-iot-devices-for-ddos-attacks</guid>
<description><![CDATA[ Cybersecurity researchers have exposed a new Mirai-derived botnet that self-identifies as xlabs_v1 and targets internet-exposed devices running Android Debug Bridge (ADB) to enlist them in a network capable of carrying out distributed denial-of-service (DDoS) attacks.
Hunt.io, which detailed the malware, said it made the discovery after identifying an exposed directory on a Netherlands-hosted ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHPb4dDONnDMbu5rdNKex39FCs_4elspTEwE3dJbDsEBn1OdHrNS_0oI2V2mKCG4PjUGsBy5T4ZCec8kSdK2hTXkaq3fIIDX5XLBKfU9X4dNamC0zGfgcZ5dxPy1PNGKtAIye5IpODYmyzgMYBSRfyUcAnLhOBsHSitLujoCQABiz9b2KfYnzUhPN8rqPK/s1600/botnet-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 07 May 2026 00:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mirai-Based, xlabs_v1, Botnet, Exploits, ADB, Hijack, IoT, Devices, for, DDoS, Attacks</media:keywords>
</item>

<item>
<title>Attacks Abuse Windows Phone Link to Steal Texts &amp;amp;amp; Bypass 2FA</title>
<link>https://block385.com/attacks-abuse-windows-phone-link-to-steal-texts-bypass-2fa</link>
<guid>https://block385.com/attacks-abuse-windows-phone-link-to-steal-texts-bypass-2fa</guid>
<description><![CDATA[ In hard-to-detect attacks, hackers are dropping the CloudZ RAT and a fresh plugin, Pheno, to hijack the Windows-based bridge between PCs and smartphones. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt1e09d5a76fa90123/69fb1b614f86c9e600c8fbcf/smartphone_warning_Mohd_Izzuan_Roslan_Alamy.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 17:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Attacks, Abuse, Windows, Phone, Link, Steal, Texts, &amp;amp, Bypass, 2FA</media:keywords>
</item>

<item>
<title>MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack</title>
<link>https://block385.com/muddywater-uses-microsoft-teams-to-steal-credentials-in-false-flag-ransomware-attack</link>
<guid>https://block385.com/muddywater-uses-microsoft-teams-to-steal-credentials-in-false-flag-ransomware-attack</guid>
<description><![CDATA[ The Iranian state-sponsored hacking group known as MuddyWater (aka Mango Sandstorm, Seedworm, and Static Kitten) has been attributed to a ransomware attack in what has been described as a &quot;false flag&quot; operation.
The attack, observed by Rapid7 in early 2026, has been found to leverage social engineering techniques via Microsoft Teams to initiate the infection sequence. Although the incident ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjE6bniWklmqJDwZMxQ07Yrb1XNwfkmJE8SGUazlNaXgn1tcbJkvCSjtbo31oAqPZwb9U9KQ-uDMPmQbxwzthxG9J2j65qOUZAph7AAMJOeXYKbcU8jYwIIyjc_i7YnSrOKQ3jPtHAuCs_vdlyWe6O3ViLRYgza2usaIoYA2GgWxKpGGl6u05IZG_QZmP_/s1600/teams-hacker.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>MuddyWater, Uses, Microsoft, Teams, Steal, Credentials, False, Flag, Ransomware, Attack</media:keywords>
</item>

<item>
<title>The Hacker News Launches &amp;apos;Cybersecurity Stars Awards 2026&amp;apos; — Submissions Now Open</title>
<link>https://block385.com/the-hacker-news-launches-cybersecurity-stars-awards-2026-submissions-now-open</link>
<guid>https://block385.com/the-hacker-news-launches-cybersecurity-stars-awards-2026-submissions-now-open</guid>
<description><![CDATA[ For nearly 20 years, we at The Hacker News have mostly told scary stories about cyberspace — big hacks, broken systems, and new threats.
But behind every headline, there’s a quieter, better story.
It’s the story of leaders making tough calls under pressure, teams building smarter defenses, and security products that keep hunting threats 24/7 — even when it’s hard.
Most of the time, this work is ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1Yg33sY2y1VE4mkNb135928ke63sPOMciQgxVLYK0vXlJfSbZPCF0Q2b6URj-uZG0YOarE7-_WKyEc2OTstYRdmcdOagHSWstqHftoc-rv7vWrKepoENsBmKnR7P9jqH6MK9z-oa3RpOks3HGTqafjHUrPp2t-Xny6btfsAMIBcPWPBXq0hZv2-7XrkE/s1600/the-hacker-news-cybersecurity-stars-awards-2026.jpg.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Hacker, News, Launches, Cybersecurity, Stars, Awards, 2026, —, Submissions, Now, Open</media:keywords>
</item>

<item>
<title>Your AI Agents Are Already Inside the Perimeter. Do You Know What They&amp;apos;re Doing?</title>
<link>https://block385.com/your-ai-agents-are-already-inside-the-perimeter-do-you-know-what-theyre-doing</link>
<guid>https://block385.com/your-ai-agents-are-already-inside-the-perimeter-do-you-know-what-theyre-doing</guid>
<description><![CDATA[ Analysts recently confirmed what identity security teams have quietly feared: AI agents are being deployed faster than enterprises can govern them. In their inaugural Market Guide for Guardian Agents, Gartner states that “enterprise adoption of AI agents is accelerating, outpacing maturity of governance policy controls.” Enterprise leaders can request access to the Gartner Market Guide for ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjb87wroQ6p8nQAYNIPc9sSFlIxMecj9qcrm9KPOaAt0-DTof7kW6e6FCc1dmoBFrtyFcZQOhyphenhyphenupMl7E3GAv-6C-5OM3U3NkEo7fKnYw-SWnwzI-yDfsY4J5kM8jgqfIqoSxHp4GJpdjK9kosjlzftCwYxSsva4jnhPHH92FT5rppUXnxCnINf05kPSzb5G/s1600/Orchid.gif" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Your, Agents, Are, Already, Inside, the, Perimeter., You, Know, What, Theyre, Doing</media:keywords>
</item>

<item>
<title>From Stuxnet to ChatGPT: 20 News Events That Shaped Cyber</title>
<link>https://block385.com/from-stuxnet-to-chatgpt-20-news-events-that-shaped-cyber</link>
<guid>https://block385.com/from-stuxnet-to-chatgpt-20-news-events-that-shaped-cyber</guid>
<description><![CDATA[ As part of its 20th anniversary celebration, Dark Reading looks back on 20 of the biggest newsmaking events from the past two decades that influenced the risk landscape for today&#039;s cybersecurity teams. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt9677f673333f2cf1/69fa1c7e14132e49be4be3e1/20-Ink_Drop-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 15:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>From, Stuxnet, ChatGPT:, News, Events, That, Shaped, Cyber</media:keywords>
</item>

<item>
<title>Research Hub Bridges Cybersecurity Gap for Under&#45;Resourced Organizations</title>
<link>https://block385.com/research-hub-bridges-cybersecurity-gap-for-under-resourced-organizations</link>
<guid>https://block385.com/research-hub-bridges-cybersecurity-gap-for-under-resourced-organizations</guid>
<description><![CDATA[ The UC Berkeley Center for Long-Term Cybersecurity (CLTC) offers tools and support to schools, local governments, and non-profits as they defend themselves against a growing volume of cyberattacks. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltb801b23c75c6d479/69ef84ca571da63ad9514579/2XMCPR9.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 15:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Research, Hub, Bridges, Cybersecurity, Gap, for, Under-Resourced, Organizations</media:keywords>
</item>

<item>
<title>Megaport enhances network resilience with integrated DDoS protection</title>
<link>https://block385.com/megaport-enhances-network-resilience-with-integrated-ddos-protection</link>
<guid>https://block385.com/megaport-enhances-network-resilience-with-integrated-ddos-protection</guid>
<description><![CDATA[ Megaport has announced the launch of Megaport DDoS Protection. This new built-in security capability for Megaport Internet allows customers to filter malicious traffic directly within the Megaport network, rather than routing it through a separate external service. This helps ensure mission-critical uptime without introducing additional latency or routing complexity. As enterprises increasingly migrate to distributed cloud environments, traditional DDoS mitigation has struggled to keep pace with cloud and distributed infrastructure adoption. Standard ISP solutions often … More →
The post Megaport enhances network resilience with integrated DDoS protection appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 13:01:50 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Megaport, enhances, network, resilience, with, integrated, DDoS, protection</media:keywords>
</item>

<item>
<title>ServiceNow strengthens enterprise AI security with Autonomous Security &amp;amp; Risk platform</title>
<link>https://block385.com/servicenow-strengthens-enterprise-ai-security-with-autonomous-security-risk-platform</link>
<guid>https://block385.com/servicenow-strengthens-enterprise-ai-security-with-autonomous-security-risk-platform</guid>
<description><![CDATA[ ServiceNow has launched Autonomous Security &amp; Risk to govern every AI agent, identity, and connected asset. Armis delivers continuous asset intelligence across code, IT, OT, IoT, and connected assets, while Veza provides fine-grained visibility, intelligence, and governance for both human and non-human identities. Security and risk crossed $1 billion in annual contract value (ACV) for ServiceNow last year, making it one of the fastest-growing sources of demand on the ServiceNow AI Platform. The pressure is … More →
The post ServiceNow strengthens enterprise AI security with Autonomous Security &amp; Risk platform appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 13:01:47 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ServiceNow, strengthens, enterprise, security, with, Autonomous, Security, Risk, platform</media:keywords>
</item>

<item>
<title>groundcover expands its observability platform with enhanced Synthetic Monitoring and RUM</title>
<link>https://block385.com/groundcover-expands-its-observability-platform-with-enhanced-synthetic-monitoring-and-rum</link>
<guid>https://block385.com/groundcover-expands-its-observability-platform-with-enhanced-synthetic-monitoring-and-rum</guid>
<description><![CDATA[ groundcover has expanded its capabilities with new and enhanced offerings across Synthetic Monitoring and Real User Monitoring (RUM). These innovations give engineering teams greater visibility into the user experience, from proactive testing to real-world session insights, while keeping data securely within their own cloud environments. “Modern observability isn’t just about infrastructure, it’s about understanding the end-to-end user experience,” said Shahar Azulay, CEO of groundcover. “These latest enhancements give teams the ability to proactively detect issues, … More →
The post groundcover expands its observability platform with enhanced Synthetic Monitoring and RUM appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 13:01:42 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>groundcover, expands, its, observability, platform, with, enhanced, Synthetic, Monitoring, and, RUM</media:keywords>
</item>

<item>
<title>New Relic advances AI observability with new intelligence layer</title>
<link>https://block385.com/new-relic-advances-ai-observability-with-new-intelligence-layer</link>
<guid>https://block385.com/new-relic-advances-ai-observability-with-new-intelligence-layer</guid>
<description><![CDATA[ New Relic has announced New Relic Knowledge, a new platform capability that integrates telemetry and knowledge sources to enhance issue detection and resolution. By combining real-time telemetry with historical incident data, system changes, and deep operational context, New Relic Knowledge provides the foundational intelligence required for AI agents and engineering teams to better understand systems, make decisions, and resolve issues faster. As a result, organizations can mitigate the $76 million risk of median annual downtime … More →
The post New Relic advances AI observability with new intelligence layer appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 13:01:34 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Relic, advances, observability, with, new, intelligence, layer</media:keywords>
</item>

<item>
<title>Root&#45;level RCE vulnerability in Palo Alto firewalls exploited (CVE&#45;2026&#45;0300)</title>
<link>https://block385.com/root-level-rce-vulnerability-in-palo-alto-firewalls-exploited-cve-2026-0300</link>
<guid>https://block385.com/root-level-rce-vulnerability-in-palo-alto-firewalls-exploited-cve-2026-0300</guid>
<description><![CDATA[ A critical vulnerability (CVE-2026-0300) affecting Palo Alto Networks firewalls is being actively exploited by attackers, the security company acknowledged today, and urged customers to implement mitigations as they are still working on fixes. About CVE-2026-0300 CVE-2026-0300 is a buffer overflow vulnerability in the User-ID Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software. The portal enables user identification for unknown traffic, i.e., situations where the firewall cannot automatically map an IP address … More →
The post Root-level RCE vulnerability in Palo Alto firewalls exploited (CVE-2026-0300) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/18153733/palo_alto_networks-1500-a.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 13:01:27 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Root-level, RCE, vulnerability, Palo, Alto, firewalls, exploited, CVE-2026-0300</media:keywords>
</item>

<item>
<title>Proton Mail brings quantum&#45;safe email encryption to all accounts</title>
<link>https://block385.com/proton-mail-brings-quantum-safe-email-encryption-to-all-accounts</link>
<guid>https://block385.com/proton-mail-brings-quantum-safe-email-encryption-to-all-accounts</guid>
<description><![CDATA[ Post-quantum protection is now available as an optional feature in Proton Mail across all plans, including the free tier. How post-quantum protection works Once enabled, Proton Mail generates new encryption keys designed to protect future encrypted emails against attacks from quantum computers. Because the feature relies on new encryption keys, users need updated Proton apps that support post-quantum protection. Older app versions do not support the new keys. “Enabling PQC helps protect new encrypted emails … More →
The post Proton Mail brings quantum-safe email encryption to all accounts appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/06093453/protonmail-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 13:01:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Proton, Mail, brings, quantum-safe, email, encryption, all, accounts</media:keywords>
</item>

<item>
<title>8×8 updates CX platform with AI, analytics, and frontline management capabilities</title>
<link>https://block385.com/88-updates-cx-platform-with-ai-analytics-and-frontline-management-capabilities</link>
<guid>https://block385.com/88-updates-cx-platform-with-ai-analytics-and-frontline-management-capabilities</guid>
<description><![CDATA[ 8×8 has released a set of platform updates to the 8×8 Platform for CX that target the operational gaps most commonly stalling organizations, including AI deployments requiring months of integration, queues IT teams cannot monitor in real time, customers abandoning sessions at login, agents stretched across simultaneous digital interactions without visibility into where their attention is going, and CRM integrations limited to natively supported platforms. The updates, spanning AI agent development, analytics, mobile authentication, and … More →
The post 8×8 updates CX platform with AI, analytics, and frontline management capabilities appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 13:01:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>8×8, updates, platform, with, AI, analytics, and, frontline, management, capabilities</media:keywords>
</item>

<item>
<title>UiPath adds agentic AI capabilities to Automation Suite for government agencies</title>
<link>https://block385.com/uipath-adds-agentic-ai-capabilities-to-automation-suite-for-government-agencies</link>
<guid>https://block385.com/uipath-adds-agentic-ai-capabilities-to-automation-suite-for-government-agencies</guid>
<description><![CDATA[ UiPath has announced the release of agentic AI capabilities on UiPath Automation Suite. The Automation Suite updates help government agencies and regulated industries accelerate agentic AI and automation adoption and are designed to address strict data sovereignty and compliance requirements. These new capabilities empower agencies to deploy agentic AI within their own infrastructure using cloud-hosted or self-hosted large language models (LLMs), maintaining control over data residency while advancing workforce productivity, operational efficiency, and constituent services. … More →
The post UiPath adds agentic AI capabilities to Automation Suite for government agencies appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 13:00:34 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>UiPath, adds, agentic, capabilities, Automation, Suite, for, government, agencies</media:keywords>
</item>

<item>
<title>Extreme Networks introduces Agent ONE for autonomous enterprise networking</title>
<link>https://block385.com/extreme-networks-introduces-agent-one-for-autonomous-enterprise-networking</link>
<guid>https://block385.com/extreme-networks-introduces-agent-one-for-autonomous-enterprise-networking</guid>
<description><![CDATA[ Extreme Networks has introduced Extreme Agent ONE, a new class of AI agents for enterprise networking. Moving beyond generic, prompt-based AI, Extreme Agent ONE runs on the Extreme AI stack purpose-built for enterprise environments, which combines advanced AI reasoning, live network context, and operational expertise to transform enterprise networks into systems that detect, decide, and act autonomously within the established governance framework. As a result, customers experience fewer disruptions, faster outcomes, and networks that operate … More →
The post Extreme Networks introduces Agent ONE for autonomous enterprise networking appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 13:00:18 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Extreme, Networks, introduces, Agent, ONE, for, autonomous, enterprise, networking</media:keywords>
</item>

<item>
<title>Intel 471 speeds threat hunting and remediation with Retroactive Threat Detections</title>
<link>https://block385.com/intel-471-speeds-threat-hunting-and-remediation-with-retroactive-threat-detections</link>
<guid>https://block385.com/intel-471-speeds-threat-hunting-and-remediation-with-retroactive-threat-detections</guid>
<description><![CDATA[ Intel 471 has announced Retroactive Threat Detections (RTD), a new capability within its Verity471 platform. RTD helps security teams quickly understand the impact of new threats on their environments. This transforms static intelligence reports into actionable answers within minutes, enabling faster confirmation of compromise and remediation. RTD generated query configured for multiple tools, delivered within the Verity471 report to retain CTI context. (Source: Intel 471) When a new threat surfaces, every CISO faces the same … More →
The post Intel 471 speeds threat hunting and remediation with Retroactive Threat Detections appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 13:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Intel, 471, speeds, threat, hunting, and, remediation, with, Retroactive, Threat, Detections</media:keywords>
</item>

<item>
<title>Why Security Leadership Makes or Breaks a Pen Test</title>
<link>https://block385.com/why-security-leadership-makes-or-breaks-a-pen-test</link>
<guid>https://block385.com/why-security-leadership-makes-or-breaks-a-pen-test</guid>
<description><![CDATA[ Well-run security drills go beyond checking audit boxes to identify and address trouble spots. Effective leaders can ensure proper scope, access, and follow-through, but it’s not easy. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3c43a304b72dbf9f/69f4fa5efd88b890dc44f905/pentest_dizain_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 13:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, Security, Leadership, Makes, Breaks, Pen, Test</media:keywords>
</item>

<item>
<title>Google&amp;apos;s Android Apps Get Public Verification to Stop Supply Chain Attacks</title>
<link>https://block385.com/googles-android-apps-get-public-verification-to-stop-supply-chain-attacks</link>
<guid>https://block385.com/googles-android-apps-get-public-verification-to-stop-supply-chain-attacks</guid>
<description><![CDATA[ Google has announced expanded Binary Transparency for Android as a way to safeguard the ecosystem from supply chain attacks.
&quot;This new public ledger ensures the Google apps on your device are exactly what we intended to build and distribute,&quot; Google&#039;s product and security teams said.
The initiative builds upon the foundation of Pixel Binary Transparency, which Google introduced in October 2021 ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3jZdmrzsI_G2u8N5XuvPgzGCHzkTGTIPHZg7O6QMeciCwLNFKkNmxL0c6lZkA06Z0lN2JEpama8zVQuSL-nLLFOqhFyU6AVuYug-he692ziNQNCWxxJKE7YHB28bVu0owc6CiMS19lRL9sOc6yg6GSs9XmjB1PW26cLqISDSFwiE2eXHjQyAhk9T9gOTe/s1600/android-app.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 12:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Googles, Android, Apps, Get, Public, Verification, Stop, Supply, Chain, Attacks</media:keywords>
</item>

<item>
<title>Windows Phone Link Exploited by CloudZ RAT to Steal Credentials and OTPs</title>
<link>https://block385.com/windows-phone-link-exploited-by-cloudz-rat-to-steal-credentials-and-otps</link>
<guid>https://block385.com/windows-phone-link-exploited-by-cloudz-rat-to-steal-credentials-and-otps</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of an intrusion that involved the use of a CloudZ remote access tool (RAT) and a previous undocumented plugin dubbed Pheno with the aim of facilitating credential theft.
&quot;According to the functionalities of the CloudZ RAT and Pheno plugin, this was with the intention of stealing victims&#039; credentials and potentially one-time passwords (OTPs),&quot; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGxYFVfOUbXRWanB_1qyRHBYCgWirEtqd3EO06BrIjnLqrTEOoTnXclKQsujA4YCVfI8Q5IWuriVAlckls65vvV2Am5PCEB1s_HHoFxpA779oT1qbnNB0Q8dqLU3GGbwINtDDmp8Ge3bdxQJWab3toekaGDgi1FFJ73uNysl8wEnXfgk6W88b1qSJcu2gX/s1600/link-to-windows.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 12:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Windows, Phone, Link, Exploited, CloudZ, RAT, Steal, Credentials, and, OTPs</media:keywords>
</item>

<item>
<title>Palo Alto PAN&#45;OS Flaw Under Active Exploitation Enables Remote Code Execution</title>
<link>https://block385.com/palo-alto-pan-os-flaw-under-active-exploitation-enables-remote-code-execution</link>
<guid>https://block385.com/palo-alto-pan-os-flaw-under-active-exploitation-enables-remote-code-execution</guid>
<description><![CDATA[ Palo Alto Networks has released an advisory warning that a critical buffer overflow vulnerability in its PAN-OS software has been exploited in the wild.
The vulnerability, tracked as CVE-2026-0300, has been described as a case of unauthenticated remote code execution. It carries a CVSS score of 9.3 if the User-ID Authentication Portal is configured to enable access from the internet or any ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgF11tAg5Rdf8st9TeSlgPkW_Rn1I3Xi4Xl6wJjNMThFLB0oYYl2kKURYxYxgtnEphAJkeHzRxVrm8LX_7i8RDXgdLQhq4HM5ecZCrv3biRciuLM2JufgdxHqJR3eNTcTsIBWJBAz1Nv8Gac1fhW0vZ8Kgb7RFOC7_9zkL7Uy_SCrFOKps1scenY4c_LPSH/s1600/paloalto.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 10:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Palo, Alto, PAN-OS, Flaw, Under, Active, Exploitation, Enables, Remote, Code, Execution</media:keywords>
</item>

<item>
<title>Middle East Cyber Battle Field Broadens — Especially in UAE</title>
<link>https://block385.com/middle-east-cyber-battle-field-broadens-especially-in-uae</link>
<guid>https://block385.com/middle-east-cyber-battle-field-broadens-especially-in-uae</guid>
<description><![CDATA[ As the war with Iran continues, breach attempts targeting the United Arab Emirates tripled in a few weeks — many targeting critical infrastructure. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt30c725b0c4078c25/69fa57448135d03599216199/UAE-Cyber-Security-Council-Arnold_O_A_Pinto-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 06 May 2026 09:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Middle, East, Cyber, Battle, Field, Broadens, —, Especially, UAE</media:keywords>
</item>

<item>
<title>Trellix Source Code Breach Highlights Growing Supply Chain Threats</title>
<link>https://block385.com/trellix-source-code-breach-highlights-growing-supply-chain-threats</link>
<guid>https://block385.com/trellix-source-code-breach-highlights-growing-supply-chain-threats</guid>
<description><![CDATA[ Info is scant, but such breaches can reveal where a security product&#039;s controls are located and how detections are designed, giving attackers a leg up. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0ce2aa588d0574d6/69fa4ff52a5a217abee03ef2/trellix_frantic_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Trellix, Source, Code, Breach, Highlights, Growing, Supply, Chain, Threats</media:keywords>
</item>

<item>
<title>Critical Apache HTTP/2 Flaw (CVE&#45;2026&#45;23918) Enables DoS and Potential RCE</title>
<link>https://block385.com/critical-apache-http2-flaw-cve-2026-23918-enables-dos-and-potential-rce</link>
<guid>https://block385.com/critical-apache-http2-flaw-cve-2026-23918-enables-dos-and-potential-rce</guid>
<description><![CDATA[ The Apache Software Foundation (ASF) has released security updates to address several security vulnerabilities in the HTTP Server, including a severe vulnerability that could potentially lead to remote code execution (RCE).
The vulnerability, tracked as CVE-2026-23918 (CVSS score: 8.8), has been described as a case of &quot;double free and possible RCE&quot; in the HTTP/2 protocol handling. This issue ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjL7seGapCGfnl8pFznQajU2KsVPCE19qbtPTJb2sqpOuurkEKNI8ZwUui6QhYmDJODr1F5L7hrpfGBQfsCOT8oC2k_gbjmRPIFWpVZLpJzcdd9nb-UJyNNg4L9LTtEto1sSo3Fn1cIgWxgsH4Xs0GlRJgEt65_Eut7FRv7aQrkqYdJXiE9zDunU2spQOVP/s1600/apache.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Critical, Apache, HTTP2, Flaw, CVE-2026-23918, Enables, DoS, and, Potential, RCE</media:keywords>
</item>

<item>
<title>DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware</title>
<link>https://block385.com/daemon-tools-supply-chain-attack-compromises-official-installers-with-malware</link>
<guid>https://block385.com/daemon-tools-supply-chain-attack-compromises-official-installers-with-malware</guid>
<description><![CDATA[ A newly identified supply chain attack targeting DAEMON Tools software has compromised its installers to serve a malicious payload, according to findings from Kaspersky.
&quot;These installers are distributed from the legitimate website of DAEMON Tools and are signed with digital certificates belonging to DAEMON Tools developers,&quot; Kaspersky researchers  Igor Kuznetsov, Georgy Kucherin, Leonid ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghQDcWhFHnIEeEngbqyPFjkweCMgT7FoZRRZV0WYRuHg1cHip2O0lw2ahMc7jhJnzOCqqrLhzpM9w-O3eLpVdiCvI4C3-RD6XwqTkDxWdhzkS-W2BsbLy_SFwnjykdvvhuhjGnwPkFpOSJiapeWULhqx9er8hDH0sCCtoK51OrH4nSYqc_oAZwILcOi1A2/s1600/daemon.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DAEMON, Tools, Supply, Chain, Attack, Compromises, Official, Installers, with, Malware</media:keywords>
</item>

<item>
<title>Microsoft Edge Stores Passwords in Process Memory, Posing Enterprise Risk</title>
<link>https://block385.com/microsoft-edge-stores-passwords-in-process-memory-posing-enterprise-risk</link>
<guid>https://block385.com/microsoft-edge-stores-passwords-in-process-memory-posing-enterprise-risk</guid>
<description><![CDATA[ A proof-of-concept exploit (PoC) shows how someone with admin privileges can exploit the issue to steal passwords, and thus use them to engage in further malicious activity. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0e4c889f98a082d1/69f9c4de2b93d911f8c512dd/Passwords-1800_designer491_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 19:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Edge, Stores, Passwords, Process, Memory, Posing, Enterprise, Risk</media:keywords>
</item>

<item>
<title>Physical Cargo Theft Gets a Boost From Cybercriminals</title>
<link>https://block385.com/physical-cargo-theft-gets-a-boost-from-cybercriminals</link>
<guid>https://block385.com/physical-cargo-theft-gets-a-boost-from-cybercriminals</guid>
<description><![CDATA[ Cargo theft is no longer about small groups of criminals operating on the ground, but transnational cybercriminal syndicates using access to supply chain systems to reroute goods. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt1a20a00c4a995c76/69f91543b4185b753bc41213/cargo-trucks-with-containers-Siwakorn1933-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 19:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Physical, Cargo, Theft, Gets, Boost, From, Cybercriminals</media:keywords>
</item>

<item>
<title>China&#45;Linked UAT&#45;8302 Targets Governments Using Shared APT Malware Across Regions</title>
<link>https://block385.com/china-linked-uat-8302-targets-governments-using-shared-apt-malware-across-regions</link>
<guid>https://block385.com/china-linked-uat-8302-targets-governments-using-shared-apt-malware-across-regions</guid>
<description><![CDATA[ A sophisticated China-nexus advanced persistent threat (APT) group has been attributed to attacks targeting government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025.
The activity is being tracked by Cisco Talos under the moniker UAT-8302, with post-exploitation involving the deployment of custom-made malware families that have been put ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhcz8_PjYKknoot4F_PnjDZ7F1HhyphenhyphenIATFohYVF1OQYLSUFwiOPknnFF3ShgQKtKtfOEUbwUcfB-xhQAbi3dBsUvKki_ooKqYmQR3KfzcC1U443sR89JlLu5oPDJcEz9GXfEo5GwtMNj8s7HGg5-qsaR0sqqkSOUBsNFcqrz9NPDPyU6lQNl2RRtADTFzK0f/s1600/chinese-hackers-2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 18:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>China-Linked, UAT-8302, Targets, Governments, Using, Shared, APT, Malware, Across, Regions</media:keywords>
</item>

<item>
<title>The Back Door Attackers Know About — and Most Security Teams Still Haven’t Closed</title>
<link>https://block385.com/the-back-door-attackers-know-about-and-most-security-teams-still-havent-closed</link>
<guid>https://block385.com/the-back-door-attackers-know-about-and-most-security-teams-still-havent-closed</guid>
<description><![CDATA[ Every AI tool, workflow automation, and productivity app your employees connected to Google or Microsoft this year left something behind: a persistent OAuth token with no expiration date, no automatic cleanup, and in most organizations, no one watching it. Your perimeter controls don&#039;t see it. Your MFA doesn&#039;t stop it. And when an attacker gets hold of one, they don&#039;t need a password.
OAuth ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMhaEkMCxALglRWDFwTHVYgZ0KrRmAuzdwfh0zbL5Ml163rakQSv8yRVQ8yTQ4xIAtcwdqvGyVXeZXgXGNYKoyStckJv2xzjH3f1O7oICND5cWbnIBGYkSVJbpDRYHH9XqNfFQNk1qWIVwd43UuJv2vozhpndzCMS789h026IKgX1t7pgp01AtI6i9wKE/s1600/material.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 16:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Back, Door, Attackers, Know, About, —, and, Most, Security, Teams, Still, Haven’t, Closed</media:keywords>
</item>

<item>
<title>MetInfo CMS CVE&#45;2026&#45;29014 Exploited for Remote Code Execution Attacks</title>
<link>https://block385.com/metinfo-cms-cve-2026-29014-exploited-for-remote-code-execution-attacks</link>
<guid>https://block385.com/metinfo-cms-cve-2026-29014-exploited-for-remote-code-execution-attacks</guid>
<description><![CDATA[ Threat actors are actively exploiting a critical security flaw impacting an open-source content management system (CMS) known as MetInfo, according to new findings from VulnCheck.
The vulnerability in question is CVE-2026-29014 (CVSS score: 9.8), a code injection flaw that could result in arbitrary code execution.
&quot;MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6SZcQRIb_0i7jqHu2mcl7Ep1hX2C3rwLWwJmBwPHTPE2PvaP9KOHcMkvGAWxLeBFWxmfpW6IXwJqIsxHJvs2nIDc2ASwRwuXNlWFZRtatpMoksz5BRKmCVNSs4BxsrFX0_CGqlHZv_6VNWx6u1wD8dydja_fvpnRLezr_CBLyX-Lj6a2i4wRKxZnGFRen/s1600/phph.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 16:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>MetInfo, CMS, CVE-2026-29014, Exploited, for, Remote, Code, Execution, Attacks</media:keywords>
</item>

<item>
<title>Microsoft: Phishing campaign used fake compliance notices to compromise employee accounts</title>
<link>https://block385.com/microsoft-phishing-campaign-used-fake-compliance-notices-to-compromise-employee-accounts</link>
<guid>https://block385.com/microsoft-phishing-campaign-used-fake-compliance-notices-to-compromise-employee-accounts</guid>
<description><![CDATA[ Phishers have been using fake workplace compliance notices to try to trick Microsoft account owners into signing in via a fake sign-in page, says the company’s Defender Research team. The email campaign targeted more than 35,000 users across 13,000 organizations in 26 countries, but concentrated primarily on targets in the United States. Microsoft didn’t say how many fell for the lure and had their account compromised. From inbox to account takeover The campaign, which ran … More →
The post Microsoft: Phishing campaign used fake compliance notices to compromise employee accounts appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/05/18153305/phishing-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 15:01:19 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft:, Phishing, campaign, used, fake, compliance, notices, compromise, employee, accounts</media:keywords>
</item>

<item>
<title>Oracle rolls out monthly security patch updates</title>
<link>https://block385.com/oracle-rolls-out-monthly-security-patch-updates</link>
<guid>https://block385.com/oracle-rolls-out-monthly-security-patch-updates</guid>
<description><![CDATA[ Oracle is changing how its security fixes are delivered: starting in May 2026, there will be a monthly Critical Security Patch Update. “Each [monthly] CSPU is smaller and more focused, making it easier to apply critical fixes quickly [to customer-managed deployments],” Oracle says. Quarterly Critical Patch Updates (CPUs) remain in place and will continue to include all fixes released in prior CSPUs. Managing security across environments Protections and updates are applied automatically and continuously in … More →
The post Oracle rolls out monthly security patch updates appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/05100628/oracle-pyramid-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 15:01:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Oracle, rolls, out, monthly, security, patch, updates</media:keywords>
</item>

<item>
<title>VIAVI CyberFlood CF1000 pushes 400G validation for multi&#45;terabit AI data centers</title>
<link>https://block385.com/viavi-cyberflood-cf1000-pushes-400g-validation-for-multi-terabit-ai-data-centers</link>
<guid>https://block385.com/viavi-cyberflood-cf1000-pushes-400g-validation-for-multi-terabit-ai-data-centers</guid>
<description><![CDATA[ VIAVI Solutions has announced the launch of its next-generation CyberFlood CF1000 Appliance, a native 400G security and application performance test platform for the validation of multi-terabit security and AI data center infrastructures at scale. Developed for network equipment vendors, hyperscale data center operators and service providers, the CyberFlood CF1000 enables OSI Layer 4-7 validation of critical infrastructure under real-world encrypted and dynamic mixed traffic conditions including Next-Generation Firewalls (NGFWs), Application Delivery Controllers (ADCs), DDoS mitigation … More →
The post VIAVI CyberFlood CF1000 pushes 400G validation for multi-terabit AI data centers appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 15:00:42 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>VIAVI, CyberFlood, CF1000, pushes, 400G, validation, for, multi-terabit, data, centers</media:keywords>
</item>

<item>
<title>Conti ransomware gang member sentenced to 102 months in prison</title>
<link>https://block385.com/conti-ransomware-gang-member-sentenced-to-102-months-in-prison</link>
<guid>https://block385.com/conti-ransomware-gang-member-sentenced-to-102-months-in-prison</guid>
<description><![CDATA[ A Latvian national who was part of a major Russian ransomware organization that stole from and extorted more than 54 companies has been sentenced to 102 months in prison. Deniss Zolotarjovs, 35, of Moscow, Russia, was part of a group linked to former members of the Conti ransomware group. Prosecutors said the group used several names in its ransom notes, including Conti, Karakurt, Royal, TommyLeaks, SchoolBoys Ransomware, and Akira. Zolotarjovs was arrested in Georgia in … More →
The post Conti ransomware gang member sentenced to 102 months in prison appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/28154435/sentence-court4-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 15:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Conti, ransomware, gang, member, sentenced, 102, months, prison</media:keywords>
</item>

<item>
<title>Download: Secure Foundations for AI Workloads on AWS</title>
<link>https://block385.com/download-secure-foundations-for-ai-workloads-on-aws</link>
<guid>https://block385.com/download-secure-foundations-for-ai-workloads-on-aws</guid>
<description><![CDATA[ Center for Internet Security helps organizations deploy AI and high-performance compute environments from a trusted, hardened operating system baseline. CIS Hardened Images help teams reduce misconfiguration risk, support compliance efforts, and move faster in AWS. What are AI-optimized CIS Hardened Images CIS Hardened Images are secure, on-demand, scalable cloud images that help organizations deploy from a more secure operating system baseline. For AI workloads on AWS, they support GPU-accelerated and distributed compute environments that need … More →
The post Download: Secure Foundations for AI Workloads on AWS appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 15:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Download:, Secure, Foundations, for, Workloads, AWS</media:keywords>
</item>

<item>
<title>How the Story of a USB Penetration Test Went Viral</title>
<link>https://block385.com/how-the-story-of-a-usb-penetration-test-went-viral</link>
<guid>https://block385.com/how-the-story-of-a-usb-penetration-test-went-viral</guid>
<description><![CDATA[ Two decades ago Dark Reading posted its first blockbuster — a column by a pen tester who sprinkled rigged thumb drives around a credit union parking lot and let curious employees do the rest. This episode looks back at the history-making piece with its author Steve Stasiukonis, Dark Reading senior editor Becky Bracken, and Dark Reading&#039;s editor-in-chief Kelly Jackson Higgins. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0469f94bd17817ff/6642699959fdc64aa5f9c5fa/dark-reading-confidential-logo-sq.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 15:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>How, the, Story, USB, Penetration, Test, Went, Viral</media:keywords>
</item>

<item>
<title>We Scanned 1 Million Exposed AI Services. Here&amp;apos;s How Bad the Security Actually Is</title>
<link>https://block385.com/we-scanned-1-million-exposed-ai-services-heres-how-bad-the-security-actually-is</link>
<guid>https://block385.com/we-scanned-1-million-exposed-ai-services-heres-how-bad-the-security-actually-is</guid>
<description><![CDATA[ While the software industry has made genuine strides over the past few decades to deliver products securely, the furious pace of AI adoption is putting that progress at risk. Businesses are moving fast to self-host LLM infrastructure, drawn by the promise of AI as a force multiplier and the pressure to deliver more value faster. But speed is coming at the expense of security.
In the wake of the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJcSH4TD_VT_40WBni-IecCy9etWtsaPKvEXzvqJrDVNl0rTIg_XXWSygEBXAIP7y4saSzakCzASpQL6vtRnHRHULD71drQ3gr-y9PpzOeeQ4JzkDGorQe26Iy7zCRp0tyc_h8EYpJYEMkYjlophh6fnhGnb0ZnRqmier4jB4nMXO2A_4j2duMoSQGKbo/s1600/intruder.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Scanned, Million, Exposed, Services., Heres, How, Bad, the, Security, Actually</media:keywords>
</item>

<item>
<title>North Korean hackers trojanize gaming platform to spy on ethnic Koreans in China</title>
<link>https://block385.com/north-korean-hackers-trojanize-gaming-platform-to-spy-on-ethnic-koreans-in-china</link>
<guid>https://block385.com/north-korean-hackers-trojanize-gaming-platform-to-spy-on-ethnic-koreans-in-china</guid>
<description><![CDATA[ A gaming platform built for ethnic Koreans in China has been serving backdoored Windows and Android software to its users since late 2024. The platform, sqgame[.]net, hosts traditional card and board games for a community that sits along the North Korean border and includes many refugees and defectors. ESET researchers tied the operation to ScarCruft, a North Korea-aligned espionage group also tracked as APT37 and Reaper, which has been active since at least 2012. How … More →
The post North Korean hackers trojanize gaming platform to spy on ethnic Koreans in China appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/30124152/altert3.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 13:00:22 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>North, Korean, hackers, trojanize, gaming, platform, spy, ethnic, Koreans, China</media:keywords>
</item>

<item>
<title>Anomali ThreatStream Next&#45;Gen speeds threat response across workflows</title>
<link>https://block385.com/anomali-threatstream-next-gen-speeds-threat-response-across-workflows</link>
<guid>https://block385.com/anomali-threatstream-next-gen-speeds-threat-response-across-workflows</guid>
<description><![CDATA[ Anomali has announced ThreatStream Next-Gen. Available standalone or within the Anomali Unified Security Data Lake, it turns threat intelligence into an active decisioning layer across security workflows, validated to drive investigations 300× faster than traditional methods across 50 enterprise deployments. Most security platforms focus on detection. Anomali focuses on decision-making. It integrates intelligence across data, analysis, and response workflows. ThreatStream Next-Gen follows this approach, providing context on attackers and campaigns, prioritization, and recommended next steps … More →
The post Anomali ThreatStream Next-Gen speeds threat response across workflows appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 13:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Anomali, ThreatStream, Next-Gen, speeds, threat, response, across, workflows</media:keywords>
</item>

<item>
<title>ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows</title>
<link>https://block385.com/scarcruft-hacks-gaming-platform-to-deploy-birdcall-malware-on-android-and-windows</link>
<guid>https://block385.com/scarcruft-hacks-gaming-platform-to-deploy-birdcall-malware-on-android-and-windows</guid>
<description><![CDATA[ The North Korea-aligned state-sponsored hacking group known as ScarCruft has compromised a video game platform in a supply chain espionage attack, trojanizing its components with a backdoor called BirdCallto likely target ethnic Koreans residing in China.
While prior versions of the backdoor have primarily targeted Windows users only, the supply chain attack is assessed to have enabled the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-UMvuxvPI2rmCsc57tI37aod9slTjeUUo0b7InSRMTwGg3UGwzu04cKgA6DE92m455noFtcxdsXfhhDlsc2CTWg8Un_DXBCEduVeDluA81mLc7YtMGBwiuVRjSmzCVXZ2jgrbb7CKnCpVZDJJLjjW5Wj6nrjpJ6B_eV7LeaK0TLGcP_wYm1P8hUjQAnsF/s1600/gear.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 12:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ScarCruft, Hacks, Gaming, Platform, Deploy, BirdCall, Malware, Android, and, Windows</media:keywords>
</item>

<item>
<title>Multiple threat actors actively exploit cPanel vulnerability (CVE&#45;2026&#45;41940)</title>
<link>https://block385.com/multiple-threat-actors-actively-exploit-cpanel-vulnerability-cve-2026-41940</link>
<guid>https://block385.com/multiple-threat-actors-actively-exploit-cpanel-vulnerability-cve-2026-41940</guid>
<description><![CDATA[ The situation around the critical cPanel authentication bypass vulnerability (CVE-2026-41940) has deteriorated significantly since our initial coverage. Exploratory probing has evolved into multi-actor exploitation, leading to disrupted websites, ransomware and malware deployment, and targeted attacks. “Sorry” ransomware Attackers have taken advantage of CVE-2026-41940 to mass-exploit vulnerable internet-facing cPanel instances to breach servers, deface websites and encrypt data. The ransomware used in some of the attacks is a Go(Lang)-based Linux encryptor that encrypts files and appends … More →
The post Multiple threat actors actively exploit cPanel vulnerability (CVE-2026-41940) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/30141939/cpanel-1500-1.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 11:01:47 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Multiple, threat, actors, actively, exploit, cPanel, vulnerability, CVE-2026-41940</media:keywords>
</item>

<item>
<title>Owl IRD enables one&#45;way forensic data transfer for incident response teams</title>
<link>https://block385.com/owl-ird-enables-one-way-forensic-data-transfer-for-incident-response-teams</link>
<guid>https://block385.com/owl-ird-enables-one-way-forensic-data-transfer-for-incident-response-teams</guid>
<description><![CDATA[ Owl Cyber Defense has announced the launch of its Incident Response Diode (IRD), a pocket-sized protocol filtering diode (PFD) designed for incident response and forensics teams. The Owl IRD was developed to help users securely move evidence from compromised endpoints into trusted analysis environments without adding risk. The Owl IRD will be made available to select customers for field testing. When an endpoint is compromised, responders must race against the clock to pull critical data … More →
The post Owl IRD enables one-way forensic data transfer for incident response teams appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 11:01:44 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Owl, IRD, enables, one-way, forensic, data, transfer, for, incident, response, teams</media:keywords>
</item>

<item>
<title>Operant AI Endpoint Protector secures AI agents and MCP tools</title>
<link>https://block385.com/operant-ai-endpoint-protector-secures-ai-agents-and-mcp-tools</link>
<guid>https://block385.com/operant-ai-endpoint-protector-secures-ai-agents-and-mcp-tools</guid>
<description><![CDATA[ Operant AI has launched Operant Endpoint Protector, a new addition to its AI Defense Platform that enables enterprise IT and security teams to discover, detect, and defend against threats across every AI tool, coding agent, and Model Context Protocol (MCP)-connected workflow used by employees, directly at the endpoint where most consequential AI activity takes place. Securing the endpoint Across every enterprise, employees in HR, finance, legal, customer service, engineering, and operations are interacting with AI … More →
The post Operant AI Endpoint Protector secures AI agents and MCP tools appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 11:01:40 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Operant, Endpoint, Protector, secures, agents, and, MCP, tools</media:keywords>
</item>

<item>
<title>DigiCert breached via malicious screensaver file</title>
<link>https://block385.com/digicert-breached-via-malicious-screensaver-file</link>
<guid>https://block385.com/digicert-breached-via-malicious-screensaver-file</guid>
<description><![CDATA[ A targeted social engineering attack against DigiCert’s support channel led to the compromise of internal systems and the unauthorized issuance of EV Code Signing certificates. DigiCert is a global Certificate Authority (CA) providing digital trust services, specializing in TLS/SSL certificates, PKI management, and IoT security. According to DigiCert’s incident report, a threat actor contacted the support team via a customer chat channel and delivered a malicious ZIP file disguised as a customer screenshot, which contained … More →
The post DigiCert breached via malicious screensaver file appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/04122650/digicert-glow-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 11:01:36 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DigiCert, breached, via, malicious, screensaver, file</media:keywords>
</item>

<item>
<title>Penske Logistics launches platform for real&#45;time supply chain visibility</title>
<link>https://block385.com/penske-logistics-launches-platform-for-real-time-supply-chain-visibility</link>
<guid>https://block385.com/penske-logistics-launches-platform-for-real-time-supply-chain-visibility</guid>
<description><![CDATA[ Penske Logistics has announced the launch of Supply Chain Insight, a secure technology platform and mobile application that provides customers with a real-time view of their supply chain operations across transportation and warehousing. Supply chain leaders are under increased pressure to drive greater operational efficiency in the face of rising fuel costs, evolving regulations and economic challenges. Organizations are looking for a competitive edge to navigate uncertain times and achieve measurable cost savings and efficiencies. … More →
The post Penske Logistics launches platform for real-time supply chain visibility appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 11:01:27 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Penske, Logistics, launches, platform, for, real-time, supply, chain, visibility</media:keywords>
</item>

<item>
<title>Critical MOVEit Automation auth bypass vulnerability fixed (CVE&#45;2026&#45;4670)</title>
<link>https://block385.com/critical-moveit-automation-auth-bypass-vulnerability-fixed-cve-2026-4670</link>
<guid>https://block385.com/critical-moveit-automation-auth-bypass-vulnerability-fixed-cve-2026-4670</guid>
<description><![CDATA[ Progress Software has fixed a critical authentication bypass (CVE-2026-4670) and a privilege escalation (CVE-2026-5174) vulnerability in MOVEit Automation, exploitation of which “may lead to unauthorized access, administrative control, and data exposure.” The vulnerabilities were reported privately by Airbus researchers and there’s no mention of them being leveraged by attackers in the wild. Still, performing an upgrade to a fixed version is “strongly” advised. CVE-2026-4670 and CVE-2026-5174 Progress Software’s MOVEit Transfer, an enterprise managed file transfer … More →
The post Critical MOVEit Automation auth bypass vulnerability fixed (CVE-2026-4670) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/06/25191718/progress-moveit-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 11:01:18 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Critical, MOVEit, Automation, auth, bypass, vulnerability, fixed, CVE-2026-4670</media:keywords>
</item>

<item>
<title>Cybersecurity jobs available right now: May 5, 2026</title>
<link>https://block385.com/cybersecurity-jobs-available-right-now-may-5-2026</link>
<guid>https://block385.com/cybersecurity-jobs-available-right-now-may-5-2026</guid>
<description><![CDATA[ Armis Security Specialist HCLTech | Ireland | On-site – View job details As an Armis Security Specialist, you will manage and optimize the Armis deployment to strengthen security across lab, OT, and IoT environments. You will maintain device visibility, refine policies and detections, and integrate Armis with other tools to improve monitoring and reduce false positives. You will identify vulnerabilities in lab devices, support remediation plans with IT and research teams, and develop procedures for … More →
The post Cybersecurity jobs available right now: May 5, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/11140413/cybersecurity_jobs-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 11:01:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybersecurity, jobs, available, right, now:, May, 2026</media:keywords>
</item>

<item>
<title>One in four MCP servers opens AI agent security to code execution risk</title>
<link>https://block385.com/one-in-four-mcp-servers-opens-ai-agent-security-to-code-execution-risk</link>
<guid>https://block385.com/one-in-four-mcp-servers-opens-ai-agent-security-to-code-execution-risk</guid>
<description><![CDATA[ Enterprise deployments of AI agents lean on two extension mechanisms that introduce risk at different layers of the stack. MCP servers expose deterministic code functions with structured, loggable invocations. Skills load textual instruction sets directly into a model’s reasoning context, where their effect depends on conversational state and cannot be enumerated the way source code can. Noma Security’s new whitepaper draws a line between the two and argues that most organizations have governed only the … More →
The post One in four MCP servers opens AI agent security to code execution risk appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/04085816/door-code-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 11:00:55 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>One, four, MCP, servers, opens, agent, security, code, execution, risk</media:keywords>
</item>

<item>
<title>Can your coding style predict whether your code is vulnerable?</title>
<link>https://block385.com/can-your-coding-style-predict-whether-your-code-is-vulnerable</link>
<guid>https://block385.com/can-your-coding-style-predict-whether-your-code-is-vulnerable</guid>
<description><![CDATA[ Developers leave fingerprints in the code they write. Naming choices, indentation patterns, preferred APIs, and the way someone structures a loop or handles a pointer all carry traces of individual habit. Researchers have used these stylistic signals for years to identify the authors of anonymous code samples, sometimes with surprising accuracy. A team at the University of Massachusetts Dartmouth is now applying the same idea to a different question: can stylistic patterns also reveal which … More →
The post Can your coding style predict whether your code is vulnerable? appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/04110833/code-programming-dev.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 11:00:40 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Can, your, coding, style, predict, whether, your, code, vulnerable</media:keywords>
</item>

<item>
<title>Meta adds proof&#45;based security to encrypted backups</title>
<link>https://block385.com/meta-adds-proof-based-security-to-encrypted-backups</link>
<guid>https://block385.com/meta-adds-proof-based-security-to-encrypted-backups</guid>
<description><![CDATA[ Meta has updated its infrastructure for protecting password-based and end-to-end encrypted backups, introducing over-the-air fleet key distribution for Messenger and a commitment to publishing evidence of secure fleet deployments. How encrypted backups work These updates build on the company’s HSM-based Backup Key Vault, which provides end-to-end encrypted backups for WhatsApp and Messenger. The system protects users’ backed-up message history with a recovery code stored in tamper-resistant hardware security modules (HSMs) that are inaccessible to Meta, … More →
The post Meta adds proof-based security to encrypted backups appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 11:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Meta, adds, proof-based, security, encrypted, backups</media:keywords>
</item>

<item>
<title>Weaver E&#45;cology RCE Flaw CVE&#45;2026&#45;22679 Actively Exploited via Debug API</title>
<link>https://block385.com/weaver-e-cology-rce-flaw-cve-2026-22679-actively-exploited-via-debug-api</link>
<guid>https://block385.com/weaver-e-cology-rce-flaw-cve-2026-22679-actively-exploited-via-debug-api</guid>
<description><![CDATA[ A critical security vulnerability in Weaver (Fanwei) E-cology, an enterprise office automation (OA) and collaboration platform, has come under active exploitation in the wild.
The vulnerability (CVE-2026-22679, CVSS score: 9.8) relates to a case of unauthenticated remote code execution affecting Weaver E-cology 10.0 versions prior to 20260312. The issue resides in the &quot;/papi/esearch/data/devops/ ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1jDJPLahWSAtaecpFMUCFQvqRj4uVR8js9Fh_awxf84YnfBOfN_hPeVhdNAZEJZGh7hGtuT_RjThlb_R6mYKf0WMpsf-AEkDIb6jYGqq-Gg4WQ2Sban7RZY6oV4MCCAkA8AXEI-4ItHk9jo5DpfoBTHWdVQIuI97MEaGYgc9xlojHS7eMq23Huhl0K7qg/s1600/weaver.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Weaver, E-cology, RCE, Flaw, CVE-2026-22679, Actively, Exploited, via, Debug, API</media:keywords>
</item>

<item>
<title>Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries</title>
<link>https://block385.com/microsoft-details-phishing-campaign-targeting-35000-users-across-26-countries</link>
<guid>https://block385.com/microsoft-details-phishing-campaign-targeting-35000-users-across-26-countries</guid>
<description><![CDATA[ Microsoft has disclosed details of a large-scale credential theft campaign that has leveraged a combination of code of conduct-themed lures and legitimate email services to direct users to attacker-controlled domains and steal authentication tokens.
The multi-stage campaign, observed between April 14 and 16, 2026, targeted more than 35,000 users across over 13,000 organizations in 26 countries, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAfU-GpnCdjg1P2f40nj2Y7eLLpsjWNa1TnSlNm3m9F7VkOryT5etD2BouMGxbfatdzukMzeCPXsDagasXWNbcwUPJNkDY-sBox3DkrA0bTYjAEOk4JV8OySSD1_Ni2DgEnoWih83X65e9K1foEaEUetNxoyXFJnGx4Np8VQWrZSnxo2UMmR0Y68L-qf0y/s1600/ms-hook.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Details, Phishing, Campaign, Targeting, 35, 000, Users, Across, Countries</media:keywords>
</item>

<item>
<title>RMM Tools Fuel Stealthy Phishing Campaign</title>
<link>https://block385.com/rmm-tools-fuel-stealthy-phishing-campaign</link>
<guid>https://block385.com/rmm-tools-fuel-stealthy-phishing-campaign</guid>
<description><![CDATA[ Attackers are abusing two remote monitoring and management (RMM) tools to evade detection in a campaign that has impacted over 80 organizations so far. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf46275f28f98b091/69f8f7d214132e1bc74be18d/rmm_Digitala_World_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 05 May 2026 01:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>RMM, Tools, Fuel, Stealthy, Phishing, Campaign</media:keywords>
</item>

<item>
<title>Exploit Cyber&#45;Frenzy Threatens Millions via Critical cPanel Vulnerability</title>
<link>https://block385.com/exploit-cyber-frenzy-threatens-millions-via-critical-cpanel-vulnerability</link>
<guid>https://block385.com/exploit-cyber-frenzy-threatens-millions-via-critical-cpanel-vulnerability</guid>
<description><![CDATA[ Shortly after the authentication-bypass flaw was disclosed multiple proof-of-concept exploits appeared, and one researcher claims there&#039;s been zero-day activity for at least a month. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd788cf590f1679de/69f8f0d8468cc9ebbfe375b3/cpanel_IBPhotography_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 23:00:01 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Exploit, Cyber-Frenzy, Threatens, Millions, via, Critical, cPanel, Vulnerability</media:keywords>
</item>

<item>
<title>Phishing Campaign Hits 80+ Orgs Using SimpleHelp and ScreenConnect RMM Tools</title>
<link>https://block385.com/phishing-campaign-hits-80-orgs-using-simplehelp-and-screenconnect-rmm-tools</link>
<guid>https://block385.com/phishing-campaign-hits-80-orgs-using-simplehelp-and-screenconnect-rmm-tools</guid>
<description><![CDATA[ An active phishing campaign has been observed targeting multiple vectors since at least April 2025, with legitimate Remote Monitoring and Management (RMM) software as a way to establish persistent remote access to compromised hosts.
The activity, codenamed VENOMOUS#HELPER, has impacted over 80 organizations, most of which are in the U.S., according to Securonix. It shares overlaps with clusters ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqa_ifaDYXI_GirxdHpZgSiE6fjnNdCmviv3QO9JsRvy1ddAWCRfoNd032ANB7pNfFMS4hLEwkfNHPHC5MNwkhK6XRjbe_y8qzWGpXRsdqhMnnUMGguScuIYtcUNQqQlmZkY4BUXy-ue6fAlor8LOfvEZNZrOq0JrIbOc2jXXAUBarqlodfdsIshRq7dXi/s1600/phishing-org.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Phishing, Campaign, Hits, 80, Orgs, Using, SimpleHelp, and, ScreenConnect, RMM, Tools</media:keywords>
</item>

<item>
<title>Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass</title>
<link>https://block385.com/progress-patches-critical-moveit-automation-bug-enabling-authentication-bypass</link>
<guid>https://block385.com/progress-patches-critical-moveit-automation-bug-enabling-authentication-bypass</guid>
<description><![CDATA[ Progress Software has released updates to address two security flaws in MOVEit Automation, including a critical bug that could result in an authentication bypass.
MOVEit Automation (formerly Central) is a secure, server-based managed file transfer (MFT) solution used to schedule and automate file movement workflows in enterprise environments without requiring any custom scripts. 
The ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTvgdRkcdOwctclhM5XBvKXGGFrqpNsd7pJsR6Qk9QfhVd52KaiNWtY6kbWYbxzweFJDx5-sXo5UmIGJZ2yKbiSqntFDcYS7aDV_hUlAuNtcFzIPf_MDdqWq9eeyzZwJXx9__K5ynAXHc-7kJ6i66ifjuGrFqfLdn4-yDTvmL1oSZ-kVX2V9eoTq-xdiKa/s1600/moveit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Progress, Patches, Critical, MOVEit, Automation, Bug, Enabling, Authentication, Bypass</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: AI&#45;Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE &amp;amp; More</title>
<link>https://block385.com/weekly-recap-ai-powered-phishing-android-spying-tool-linux-exploit-github-rce-more</link>
<guid>https://block385.com/weekly-recap-ai-powered-phishing-android-spying-tool-linux-exploit-github-rce-more</guid>
<description><![CDATA[ This week, the shadows moved faster than the patches.
While most teams were still triaging last month’s alerts, attackers had already turned control panels into kill switches, kernels into open doors, and open-source pipelines into silent delivery systems.
The game has shifted from breach to occupation. They’re living inside SaaS sessions, pushing code with trusted commits, and scaling ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_j3mVDqxMVjGlF1qpGV3nSUfIhHsxGDl7Nt6QQFwRUA-qOtj22zKVcE7B7UTCcjLdUrsjLPB5N7TiX8Hzjx8Hq8LPy_GdAfcO_AqMwDDWRyQ6dWdeXzFOQa1KYm8rUUDCgwCbR9kN7OCheQyc0Ijz2MuXGkY6bsqHwlBtV34Q6xH2VAPRDUjFFThKk46X/s1600/CYBERRECAP.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 18:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>⚡, Weekly, Recap:, AI-Powered, Phishing, Android, Spying, Tool, Linux, Exploit, GitHub, RCE, More</media:keywords>
</item>

<item>
<title>Silver Fox Springs Tax&#45;Themed Attacks on Orgs in India, Russia</title>
<link>https://block385.com/silver-fox-springs-tax-themed-attacks-on-orgs-in-india-russia</link>
<guid>https://block385.com/silver-fox-springs-tax-themed-attacks-on-orgs-in-india-russia</guid>
<description><![CDATA[ More than 1,600 socially engineered messages from the China-backed advanced persistent threat (APT) group target various sectors to deliver the previously undocumented ABCDoor backdoor, ValleyRAT, and other malware. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blta82565fb6653cd0e/69f88e988135d0869c215e99/silver-fox-closeup-ambquinn-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Silver, Fox, Springs, Tax-Themed, Attacks, Orgs, India, Russia</media:keywords>
</item>

<item>
<title>How Dark Reading Lifted Off the Launchpad in 2006</title>
<link>https://block385.com/how-dark-reading-lifted-off-the-launchpad-in-2006</link>
<guid>https://block385.com/how-dark-reading-lifted-off-the-launchpad-in-2006</guid>
<description><![CDATA[ Twenty years ago, this media brand didn&#039;t have a print edition to attract eyeballs and sponsors. Top-notch content and editorial talent did the heavy lifting. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt68bbd8619ec3a55e/69f4fc58074d2d36cd223882/rocket_Tribune_Content_Agency_LLC.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 15:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>How, Dark, Reading, Lifted, Off, the, Launchpad, 2006</media:keywords>
</item>

<item>
<title>2026: The Year of AI&#45;Assisted Attacks</title>
<link>https://block385.com/2026-the-year-of-ai-assisted-attacks</link>
<guid>https://block385.com/2026-the-year-of-ai-assisted-attacks</guid>
<description><![CDATA[ On December 4, 2025, a 17-year-old was arrested in Osaka under Japan’s Unauthorized Access Prohibition Act. The young man had run malicious code to extract the personal data of over 7 million users of Kaikatsu Club, Japan&#039;s largest internet cafe chain. When asked, the young man shared his motivation for the hack: he wanted to buy Pokémon cards.
In a sense, this is a fairly conventional story. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEji6GV4hhCDB_wJkm6REZZfugW5H5hF8g8X27oGcUHnOSxYst1aJJspKKl6joygytGLwgKYvfDU_DD8DFHQ-vPt-_Tc1yzG8fJl_0tHuyOLgJC3eHKGFM_YZA_OIYoL7wI8lUWZrpGO_E2Sjunen7Y9g2fY7sRTi6cvk4DgBW5plToR5U-Je5GQeJsKuqY/s1600/ai-cyberattacks.png" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 14:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>2026:, The, Year, AI-Assisted, Attacks</media:keywords>
</item>

<item>
<title>Silver Fox Deploys ABCDoor Malware via Tax&#45;Themed Phishing in India and Russia</title>
<link>https://block385.com/silver-fox-deploys-abcdoor-malware-via-tax-themed-phishing-in-india-and-russia</link>
<guid>https://block385.com/silver-fox-deploys-abcdoor-malware-via-tax-themed-phishing-in-india-and-russia</guid>
<description><![CDATA[ The China-based cybercrime group known as Silver Fox has been linked to a new campaign targeting organizations in Russia and India with a new malware called ABCDoor.
The activity involved using phishing emails that mimic correspondence from the Income Tax Department of India in December 2025, followed by a similar campaign aimed at Russian entities.
&quot;Both waves followed a nearly identical ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjfw7HlDQIzbgA8xy1bk-sUkn-TVS85DGaL4vQkuTNYu3SGabQGuPKBD7C1qkCcpxwEFfdW6I9DJoSnmMmbkAu24SN1R_B2HNYwi-niSiST1LJqwMQ7tspMjxMyHXJtZUxGZbb2Hb1k-_2ywcG5hWFhOKQubJsYXiq8hyphenhyphenFfLyVewIet_ZcdTmNZEc9-Fum/s1600/godd.png" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 14:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Silver, Fox, Deploys, ABCDoor, Malware, via, Tax-Themed, Phishing, India, and, Russia</media:keywords>
</item>

<item>
<title>Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks</title>
<link>https://block385.com/critical-cpanel-vulnerability-weaponized-to-target-government-and-msp-networks</link>
<guid>https://block385.com/critical-cpanel-vulnerability-weaponized-to-target-government-and-msp-networks</guid>
<description><![CDATA[ A previously unknown threat actor has been observed targeting government and military entities in Southeast Asia, alongside a smaller cluster of managed service providers (MSPs) and hosting providers in the Philippines, Laos, Canada, South Africa, and the U.S., by exploiting the recently disclosed vulnerability in cPanel.
The activity, detected by Ctrl-Alt-Intel on May 2, 2026, involves the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlgjtQddA9U3D-xf2UWj5GKV2R5tEwjqWWY9fwRQi_fZgG5tf140uw2P4oVfmcvPZcMYuFDo1mvqYKkgKSmgfBxVloaWTrN7vgPiH1FX8ivdh8PFBN9LvfJF13a0ajbXDLEV20pr9d2rSoQo4KWbDYSpSOFJYoPYDHizXQ3tYNGVhhysD8h3FWWpOkHytN/s1600/ccc.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 14:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Critical, cPanel, Vulnerability, Weaponized, Target, Government, and, MSP, Networks</media:keywords>
</item>

<item>
<title>Lens Agents brings policy control to AI across cloud and desktop</title>
<link>https://block385.com/lens-agents-brings-policy-control-to-ai-across-cloud-and-desktop</link>
<guid>https://block385.com/lens-agents-brings-policy-control-to-ai-across-cloud-and-desktop</guid>
<description><![CDATA[ Lens by Mirantis has announced Lens Agents, a governed platform for running AI agents across enterprise systems, giving organizations a unified, policy-driven way to run, secure, and scale AI agents across desktop and cloud environments. Available in early access, Lens Agents enables organizations to connect any AI agent, including desktop tools like Claude, Cursor, and Copilot, external autonomous agents built on any framework, and platform agents created directly on Lens Agents, to enterprise systems with … More →
The post Lens Agents brings policy control to AI across cloud and desktop appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 11:00:38 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Lens, Agents, brings, policy, control, across, cloud, and, desktop</media:keywords>
</item>

<item>
<title>15&#45;year&#45;old detained over massive data breach at French government agency</title>
<link>https://block385.com/15-year-old-detained-over-massive-data-breach-at-french-government-agency</link>
<guid>https://block385.com/15-year-old-detained-over-massive-data-breach-at-french-government-agency</guid>
<description><![CDATA[ French authorities have detained a 15-year-old suspected of involvement in a data breach at France Titres, the government agency responsible for issuing official documents. “Between 12 and 18 million data records were reportedly being offered for sale on cybercriminal forums by a hacker known as “breach3d,“ the Paris Prosecutor’s Office said in a press release. ANTS detected suspicious activity on its network on April 13 and confirmed the authenticity of the data being sold. The … More →
The post 15-year-old detained over massive data breach at French government agency appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 11:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>15-year-old, detained, over, massive, data, breach, French, government, agency</media:keywords>
</item>

<item>
<title>Your work apps are quietly handing 19 data points to someone</title>
<link>https://block385.com/your-work-apps-are-quietly-handing-19-data-points-to-someone</link>
<guid>https://block385.com/your-work-apps-are-quietly-handing-19-data-points-to-someone</guid>
<description><![CDATA[ Office work in 2026 runs through a stack of mobile apps that sit on the same phones people use for banking, messaging family, and tracking their location. Ten of the most common workplace apps in use across U.S. companies, including Gmail, Microsoft Teams, Zoom Workplace, Slack, and Notion, account for more than 12.5 billion downloads on Google Play. New research from Incogni, based on data pulled from the Google Play Store on March 20, 2026, … More →
The post Your work apps are quietly handing 19 data points to someone appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/29170828/watch-eye-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 09:00:58 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Your, work, apps, are, quietly, handing, data, points, someone</media:keywords>
</item>

<item>
<title>What researchers learned about building an LLM security workflow</title>
<link>https://block385.com/what-researchers-learned-about-building-an-llm-security-workflow</link>
<guid>https://block385.com/what-researchers-learned-about-building-an-llm-security-workflow</guid>
<description><![CDATA[ Security operations centers are running into the same wall everywhere. Detection tools generate more alerts than analysts can work through, and the early stages of any investigation involve pulling together logs from several sources to decide whether something is worth escalating. Vendors have spent the past two years pitching LLMs as the answer, with a steady stream of copilots and AI assistants aimed at alert triage. A new paper from researchers at the University of … More →
The post What researchers learned about building an LLM security workflow appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/11055053/brain-ai-yellow.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 09:00:51 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>What, researchers, learned, about, building, LLM, security, workflow</media:keywords>
</item>

<item>
<title>Spotting third&#45;party cyber risk before attackers do</title>
<link>https://block385.com/spotting-third-party-cyber-risk-before-attackers-do</link>
<guid>https://block385.com/spotting-third-party-cyber-risk-before-attackers-do</guid>
<description><![CDATA[ In this Help Net Security video, Jeffrey Wheatman, SVP and Cyber Strategist at Black Kite, discusses how organizations can identify and manage third-party cyber exposures before attackers exploit them. He argues that businesses should move beyond a data-loss mindset toward one centered on resilience, meaning keeping operations running when vendors or partners get hit. Wheatman walks through practical steps: engaging business stakeholders early, scoping which third parties are business critical, retiring outdated questionnaire-based assessments, and … More →
The post Spotting third-party cyber risk before attackers do appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/10174428/find-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 09:00:42 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Spotting, third-party, cyber, risk, before, attackers</media:keywords>
</item>

<item>
<title>Pipelock: Open&#45;source AI agent firewall</title>
<link>https://block385.com/pipelock-open-source-ai-agent-firewall</link>
<guid>https://block385.com/pipelock-open-source-ai-agent-firewall</guid>
<description><![CDATA[ AI coding agents run with shell access, environment variables containing API keys, and unrestricted internet connectivity, creating a single point of failure where one compromised tool call can leak credentials to an attacker-controlled domain. Pipelock, an open-source security harness developed by Joshua Waldrep under the PipeLab project, addresses this exposure by inserting an enforcement layer between agents and the network. Version 2.3.0 shipped with class-preserving request redaction and generic SSE streaming response scanning. Architecture and … More →
The post Pipelock: Open-source AI agent firewall appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/29102655/pipelock_ai_agent_firewall-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 09:00:26 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Pipelock:, Open-source, agent, firewall</media:keywords>
</item>

<item>
<title>Brush shell 0.4.0 tightens script safety, widens platform support</title>
<link>https://block385.com/brush-shell-040-tightens-script-safety-widens-platform-support</link>
<guid>https://block385.com/brush-shell-040-tightens-script-safety-widens-platform-support</guid>
<description><![CDATA[ Rust-based alternatives to traditional Unix shells continue to attract users who want bash compatibility alongside built-in features like syntax highlighting and history-based suggestions. Brush, a bash- and POSIX-compatible shell written in Rust, sits in that group, and version 0.4.0 brings more than 200 merged pull requests representing several months of development. Bash features filled in The release closes several long-standing gaps in bash compatibility. Brush now implements set -e (errexit) and pipefail with the same … More →
The post Brush shell 0.4.0 tightens script safety, widens platform support appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/05/04081412/brush_shell-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 09:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Brush, shell, 0.4.0, tightens, script, safety, widens, platform, support</media:keywords>
</item>

<item>
<title>Global Crackdown Arrests 276, Shuts 9 Crypto Scam Centers, Seizes $701M</title>
<link>https://block385.com/global-crackdown-arrests-276-shuts-9-crypto-scam-centers-seizes-701m</link>
<guid>https://block385.com/global-crackdown-arrests-276-shuts-9-crypto-scam-centers-seizes-701m</guid>
<description><![CDATA[ A coordinated international operation involving U.S. and Chinese authorities has arrested at least 276 suspects and shut down nine scam centers used for cryptocurrency investment fraud schemes targeting Americans, resulting in millions of dollars in losses.
The crackdown was led by the Dubai Police, under the United Arab Emirates (UAE) Ministry of Interior, in partnership with the U.S. Federal ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVrpguh4mhS2wkIhYWPYbS2Nsjl1RPI5gpXYCZwdMyJtKk9uRU1yDIxTq7itnRWazzARvSlJ9oZTsKvGyWqOMjGyOPQ0YX6nNgUuJ9R2dD0X3Mv9Bjc0HvY3TeZHVQfLhXZd-w88FMBV71qJCVedcKQhL0Wd8YH7Jzwbasus9GF6LLzaRGG0tOFxP5TwmS/s1600/SCAMS.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 08:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Global, Crackdown, Arrests, 276, Shuts, Crypto, Scam, Centers, Seizes, 701M</media:keywords>
</item>

<item>
<title>ChatGPT advanced account security adds passkeys and hardware keys</title>
<link>https://block385.com/chatgpt-advanced-account-security-adds-passkeys-and-hardware-keys</link>
<guid>https://block385.com/chatgpt-advanced-account-security-adds-passkeys-and-hardware-keys</guid>
<description><![CDATA[ Journalists, elected officials, researchers, and political dissidents have spent years adapting their accounts to phishing-resistant authentication on consumer platforms. ChatGPT now joins that list. OpenAI has introduced Advanced Account Security, an opt-in setting that strips password-based sign-in from ChatGPT and Codex accounts and replaces it with passkeys or physical security keys. What enrollment changes Enrolled accounts use passkeys or hardware security keys for sign-in, with password login disabled. Email and SMS account recovery are removed, … More →
The post ChatGPT advanced account security adds passkeys and hardware keys appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Mon, 04 May 2026 01:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ChatGPT, advanced, account, security, adds, passkeys, and, hardware, keys</media:keywords>
</item>

<item>
<title>Week in review: High&#45;severity LPE vulnerability in the Linux kernel, cPanel 0&#45;day exploited for months</title>
<link>https://block385.com/week-in-review-high-severity-lpe-vulnerability-in-the-linux-kernel-cpanel-0-day-exploited-for-months</link>
<guid>https://block385.com/week-in-review-high-severity-lpe-vulnerability-in-the-linux-kernel-cpanel-0-day-exploited-for-months</guid>
<description><![CDATA[ Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: The AI criminal mastermind is already hiring on gig platforms Labor-hire platforms let anyone with a credit card post a task and pay a stranger to complete it. The RentAHuman platform extends that model to AI agents through a Model Context Protocol server, allowing an agent to post gigs directly. Listed tasks include attending in-person meetings, photographing locations, delivering items, … More →
The post Week in review: High-severity LPE vulnerability in the Linux kernel, cPanel 0-day exploited for months appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/25124830/cybersecurity-week-review-1-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Sun, 03 May 2026 11:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Week, review:, High-severity, LPE, vulnerability, the, Linux, kernel, cPanel, 0-day, exploited, for, months</media:keywords>
</item>

<item>
<title>CISA Adds Actively Exploited Linux Root Access Bug CVE&#45;2026&#45;31431 to KEV</title>
<link>https://block385.com/cisa-adds-actively-exploited-linux-root-access-bug-cve-2026-31431-to-kev</link>
<guid>https://block385.com/cisa-adds-actively-exploited-linux-root-access-bug-cve-2026-31431-to-kev</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a recently disclosed security flaw impacting various Linux distributions to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.
The vulnerability, tracked as CVE-2026-31431 (CVSS score: 7.8), is a case of local privilege escalation (LPE) flaw that could allow an ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEibNApjovicg4aFV0VPiue9cUMmH_D-GkLlWwgXunP_-fUi8cRWaNM6Kl2TV99eBRKKVdXNq-0iQ2EJLotLO_TAvIA3xW-mE-tS5BDHSKrUmTgGuGEbAp4ek6uFJk4yRTsgJu6LStR3BqJkIm4fyXgZiBKxNGI0YBLiiAneTRvem-Ydh3gbIVsz8O0VBUQy/s1600/linux-root.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 03 May 2026 10:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, Adds, Actively, Exploited, Linux, Root, Access, Bug, CVE-2026-31431, KEV</media:keywords>
</item>

<item>
<title>Trellix Confirms Source Code Breach With Unauthorized Repository Access</title>
<link>https://block385.com/trellix-confirms-source-code-breach-with-unauthorized-repository-access</link>
<guid>https://block385.com/trellix-confirms-source-code-breach-with-unauthorized-repository-access</guid>
<description><![CDATA[ Cybersecurity company Trellix has announced that it suffered a breach that enabled unauthorized access to a &quot;portion&quot; of its source code.
It said it &quot;recently identified&quot; the compromise of its source code repository and that it began working with &quot;leading forensic experts&quot; to resolve the matter immediately. It also said it has notified law enforcement of the matter.
Trellix did not disclose the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJ47NY9D4DSEZHqBNSGTjpmSJqwYVOzlIKGoG-0LTxSdIIDrMtyV2tOqRYcc-4kpxkE1UZ6nJhK4eXCGEsEmG6UcQeHn_YjAhRWXIAxo5yC75eUmLv3w5rur6SN6Qoee65gve-LgM0_3YGnAzQwTrQMTeTShRe_leh8_ImIlzU-Sgfy2kRqTcx5V-yG-3M/s1600/breach.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 02 May 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Trellix, Confirms, Source, Code, Breach, With, Unauthorized, Repository, Access</media:keywords>
</item>

<item>
<title>76% of All Crypto Stolen in 2026 Is Now in North Korea</title>
<link>https://block385.com/76-of-all-crypto-stolen-in-2026-is-now-in-north-korea</link>
<guid>https://block385.com/76-of-all-crypto-stolen-in-2026-is-now-in-north-korea</guid>
<description><![CDATA[ North Korean threat actors are pulling off historic cryptocurrency heists on a yearly, sometimes weekly basis now. AI might be helping them. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte54957ba444b76ce/69f4f5e31d1c5178ebec2907/DPRK_USD-Lightboxx-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 23:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>76, All, Crypto, Stolen, 2026, Now, North, Korea</media:keywords>
</item>

<item>
<title>30,000 Facebook Accounts Hacked via Google AppSheet Phishing Campaign</title>
<link>https://block385.com/30000-facebook-accounts-hacked-via-google-appsheet-phishing-campaign</link>
<guid>https://block385.com/30000-facebook-accounts-hacked-via-google-appsheet-phishing-campaign</guid>
<description><![CDATA[ A newly discovered Vietnamese-linked operation has been observed using a Google AppSheet as a &quot;phishing relay&quot; to distribute phishing emails with an aim to compromise Facebook accounts.
The activity has been codenamed AccountDumpling by Guardio, with the scheme selling the stolen accounts back through an illicit storefront run by the threat actors. In all, roughly 30,000 Facebook accounts are ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilUS_xmTpvaJtwhFTnxsBtKSx2hWroMJKWUCKeB_CNx_9-5T85bdpqGfTZ0__XITi-i6ZnndaiiiFggf3Cgf-35KK-G6sEwvnlqom2DK6U-oH_o9GhEGNyd9kiSti-QC_dpl3v7b7IniC9kAUzV265yVbVsWAnLnH1RfQxrftUHj5MFAm03MOBw3Z6UEVb/s1600/phish.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 22:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>30, 000, Facebook, Accounts, Hacked, via, Google, AppSheet, Phishing, Campaign</media:keywords>
</item>

<item>
<title>If AI&amp;apos;s So Smart, Why Does It Keep Deleting Production Databases?</title>
<link>https://block385.com/if-ais-so-smart-why-does-it-keep-deleting-production-databases</link>
<guid>https://block385.com/if-ais-so-smart-why-does-it-keep-deleting-production-databases</guid>
<description><![CDATA[ The issue isn&#039;t artificial intelligence, but rather an industry adding AI agent integrations into production environments before proper security testing. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltaf39bbd62b1f2473/69f3a68381ac09c28dfa5350/binary_match_Brain_light_alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 19:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AIs, Smart, Why, Does, Keep, Deleting, Production, Databases</media:keywords>
</item>

<item>
<title>Cybercrime Groups Using Vishing and SSO Abuse in Rapid SaaS Extortion Attacks</title>
<link>https://block385.com/cybercrime-groups-using-vishing-and-sso-abuse-in-rapid-saas-extortion-attacks</link>
<guid>https://block385.com/cybercrime-groups-using-vishing-and-sso-abuse-in-rapid-saas-extortion-attacks</guid>
<description><![CDATA[ Cybersecurity researchers are warning of two cybercrime groups that are carrying out &quot;rapid, high-impact attacks&quot; operating almost within the confines of SaaS environments, while leaving minimal traces of their actions.
The clusters, Cordial Spider (aka BlackFile, CL-CRI-1116, O-UNC-045, and UNC6671) and Snarky Spider (aka O-UNC-025 and UNC6661), have been attributed to high-speed data theft and ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4FSyjacFNJX32YMLQvN6jUeVwGJfoAHPLMIhtU6aNS6hrkIUokynaWWzqxOjr1JsP0lIooaL0ppYM-iQ_rEH2ruoqMw1UAb_bq4FNjI16P6P7CpTaYSkJtp-TpCFKOce9ODtmzskcTZnuWFLYyUdfA0UeHqmRVVNB1P6Mw28a5Yuc7T1kgEx4Pcyxbcsr/s1600/vishing.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 18:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybercrime, Groups, Using, Vishing, and, SSO, Abuse, Rapid, SaaS, Extortion, Attacks</media:keywords>
</item>

<item>
<title>China&#45;Linked Hackers Target Asian Governments, NATO State, Journalists, and Activists</title>
<link>https://block385.com/china-linked-hackers-target-asian-governments-nato-state-journalists-and-activists</link>
<guid>https://block385.com/china-linked-hackers-target-asian-governments-nato-state-journalists-and-activists</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a new China-aligned espionage campaign targeting government and defense sectors across South, East, and Southeast Asia, along with one European government belonging to NATO.
Trend Micro has attributed the activity to a threat activity cluster it tracks under the temporary designation SHADOW-EARTH-053. The adversarial collective is assessed to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhD3mr1fHyy1yT3u6ebxE9skoiCRtBYdZnkvdputmKF0XgZW5BKeQKkvnYswwusYFG4tvzVeWOqP3wgGtqLA7Ds9I-PYlasFVkOmaClo8IIpRGtdvuFZuKzDgvktukM1YXbTDbBAZUfk1mtWx8lHFF8N_YZXRl0ncSWtGGkzXDkm5gWMovjixeiyh6w_64W/s1600/chinese-hackers.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 18:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>China-Linked, Hackers, Target, Asian, Governments, NATO, State, Journalists, and, Activists</media:keywords>
</item>

<item>
<title>Download: Automating Pentest Delivery Guide</title>
<link>https://block385.com/download-automating-pentest-delivery-guide</link>
<guid>https://block385.com/download-automating-pentest-delivery-guide</guid>
<description><![CDATA[ Pentesting remains one of the most effective ways to identify real-world weaknesses, but the method for delivering results hasn’t evolved. Manual workflows involving static documents and email threads introduce delays, create inefficiencies, and diminish the value of the work. This guide on Automating Pentest Delivery teaches you how to modernize your workflows and transform traditional reporting into a continuous, collaborative process where findings become actionable the moment they’re discovered. Inside, you’ll learn how automation is … More →
The post Download: Automating Pentest Delivery Guide appeared first on Help Net Security. ]]></description>
<enclosure url="https://plextrac.com/wp-content/uploads/2025/11/Automate-Pentesting-Ebook-3d-Updated-web.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 17:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Download:, Automating, Pentest, Delivery, Guide</media:keywords>
</item>

<item>
<title>Name That Toon: Mark of (Security) Progress</title>
<link>https://block385.com/name-that-toon-mark-of-security-progress</link>
<guid>https://block385.com/name-that-toon-mark-of-security-progress</guid>
<description><![CDATA[ Feeling creative? Have something to say about the last 20 years of cybersecurity? Our editors will award the best cybersecurity-related caption with a $20 gift card. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltdbf0428151d81445/69f49269d987a6e491ac5a94/name-toon-may2026.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 15:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Name, That, Toon:, Mark, Security, Progress</media:keywords>
</item>

<item>
<title>20 Years in Cyber: Dark Reading Marks Milestone With Month of Special Coverage</title>
<link>https://block385.com/20-years-in-cyber-dark-reading-marks-milestone-with-month-of-special-coverage</link>
<guid>https://block385.com/20-years-in-cyber-dark-reading-marks-milestone-with-month-of-special-coverage</guid>
<description><![CDATA[ On this day in 2006, Dark Reading went live. We have a celebration planned that spans our two decades of covering the industry, and you, dear readers, are invited. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltfa15fad832804f71/69f25b673c5d474c908e45aa/KJHCol_DR20.jpeg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 15:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Years, Cyber:, Dark, Reading, Marks, Milestone, With, Month, Special, Coverage</media:keywords>
</item>

<item>
<title>Top Five Sales Challenges Costing MSPs Cybersecurity Revenue</title>
<link>https://block385.com/top-five-sales-challenges-costing-msps-cybersecurity-revenue</link>
<guid>https://block385.com/top-five-sales-challenges-costing-msps-cybersecurity-revenue</guid>
<description><![CDATA[ The managed security services market is projected to grow from $38.31 billion in 2025 to $69.16 billion by 2030[1], with cybersecurity being the fastest-growing sector[2]. Despite this opportunity, many MSPs leave revenue on the table because their go-to-market strategy fails to connect technical expertise with business needs.
This execution gap is where most deals stall. MSPs often focus on ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgc4T6K9zSg5-BFr6xjfFnVhxj3Jx5R5CCUbEmTDssJXlPDiPYcCwFRAfSP_09Kcds90YN7CUwv2Y5ZhglKxLgEbyDRaudcoZXL1PfftGo5BloLB9LInZGWvVaKEdYEoHBJjyP3wwxkfEWWg4pcPTtBUnr6zCJRvre9YzZs4OagcnBVFiAbjbEGc7WY-98/s1600/cynomi.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 14:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Top, Five, Sales, Challenges, Costing, MSPs, Cybersecurity, Revenue</media:keywords>
</item>

<item>
<title>Two Cybersecurity Professionals Get 4&#45;Year Sentences in BlackCat Ransomware Attacks</title>
<link>https://block385.com/two-cybersecurity-professionals-get-4-year-sentences-in-blackcat-ransomware-attacks</link>
<guid>https://block385.com/two-cybersecurity-professionals-get-4-year-sentences-in-blackcat-ransomware-attacks</guid>
<description><![CDATA[ The U.S. Department of Justice (DoJ) on Thursday announced the sentencing of two cybersecurity professionals to four years each in prison for their role in facilitating BlackCat ransomware attacks in 2023.
Ryan Goldberg, 40, of Georgia, and Kevin Martin, 36, of Texas, were accused of deploying the ransomware against multiple victims located throughout the U.S. between April and December 2023. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxhvaGpPe8ES3q62CqgJTkgm4Raiy6ugjF7dOgRUC4Sd6SsspaPB7tzYYK8lmeUi__TGffqjUeumdmUnA34ZmWJKLDG-TGoZXbyaFAaGR_49JYN9GxVGFQ13allcDdinlnrqtOUeRW6M3wdgvPyRYT_TzmYLpjYPGjYi43laVhtbrPjXs3P7dmN_DQ1Lnd/s1600/ransomware-install.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 14:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Two, Cybersecurity, Professionals, Get, 4-Year, Sentences, BlackCat, Ransomware, Attacks</media:keywords>
</item>

<item>
<title>Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft</title>
<link>https://block385.com/poisoned-ruby-gems-and-go-modules-exploit-ci-pipelines-for-credential-theft</link>
<guid>https://block385.com/poisoned-ruby-gems-and-go-modules-exploit-ci-pipelines-for-credential-theft</guid>
<description><![CDATA[ A new software supply chain attack campaign has been observed using sleeper packages as a conduit to subsequently push malicious payloads that enabled credential theft, GitHub Actions tampering, and SSH persistence.
The activity has been attributed to the GitHub account &quot;BufferZoneCorp,&quot; which has published a set of repositories that are associated with malicious Ruby gems and Go modules. As of ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNz4euGufhcyWdY8TkRfdXBUj2XXZlzQWEb1QyI7otpos158ctsC236sEm2NAZ20sUZv4AOqrGCSTbjGsOOkMwhQv53ZjyrVXf9SVUsMfhvhQ4LzGL87j44f0kMkXRzBAoWeHDz8hywx4gbW_trN1mFk-xCCZatTf0zNsude7k-3WE9kIY_pPgza53qsdc/s1600/buffer.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 12:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Poisoned, Ruby, Gems, and, Modules, Exploit, Pipelines, for, Credential, Theft</media:keywords>
</item>

<item>
<title>Identity is the control plane for distributed infrastructure</title>
<link>https://block385.com/identity-is-the-control-plane-for-distributed-infrastructure</link>
<guid>https://block385.com/identity-is-the-control-plane-for-distributed-infrastructure</guid>
<description><![CDATA[ Teleport CEO Ev Kontsevoy makes the case that distributed infrastructure, across cloud, Kubernetes, databases, and servers, can’t be secured by layering more tools on top of fragmented identity systems. He argues for fewer credentials, fewer entry points, and a single identity layer that gives security and engineering teams unified visibility and control.
The post Identity is the control plane for distributed infrastructure appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/09/12150859/identity-face-1-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 09:00:32 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Identity, the, control, plane, for, distributed, infrastructure</media:keywords>
</item>

<item>
<title>Shadow AI risks deepen as 31% of users get no employer training</title>
<link>https://block385.com/shadow-ai-risks-deepen-as-31-of-users-get-no-employer-training</link>
<guid>https://block385.com/shadow-ai-risks-deepen-as-31-of-users-get-no-employer-training</guid>
<description><![CDATA[ Between one-fifth and one-third of workers use AI outside the influence and governance of the IT function, according to a global survey of 6,000 full-time employees at enterprise organizations. Researchers found a widening gap between employee AI adoption and the controls organizations have in place to manage it. The Lenovo Work Reborn Research Series 2026 report documents a workforce split into two groups: employees equipped with IT-managed tools, training, and oversight, and those operating independently … More →
The post Shadow AI risks deepen as 31% of users get no employer training appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/31083710/shadow-ai.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 09:00:21 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Shadow, risks, deepen, 31, users, get, employer, training</media:keywords>
</item>

<item>
<title>Open&#45;source privacy proxy masks PII before prompts reach external AI services</title>
<link>https://block385.com/open-source-privacy-proxy-masks-pii-before-prompts-reach-external-ai-services</link>
<guid>https://block385.com/open-source-privacy-proxy-masks-pii-before-prompts-reach-external-ai-services</guid>
<description><![CDATA[ Enterprise developers routinely send prompts to external large language models that contain customer emails, support transcripts, and other identifying information, often without a sanitization layer between the application and the API. Dataiku has released Kiji Privacy Proxy, an open-source local gateway that detects and masks personally identifiable information before requests leave the network. The tool sits between local applications and external AI APIs such as OpenAI and Anthropic. Inbound requests pass through a machine learning … More →
The post Open-source privacy proxy masks PII before prompts reach external AI services appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/29122319/dataiku_kiji_privacy_proxy.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 09:00:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Open-source, privacy, proxy, masks, PII, before, prompts, reach, external, services</media:keywords>
</item>

<item>
<title>New infosec products of the month: April 2026</title>
<link>https://block385.com/new-infosec-products-of-the-month-april-2026</link>
<guid>https://block385.com/new-infosec-products-of-the-month-april-2026</guid>
<description><![CDATA[ Here’s a look at the most interesting products from the past month, featuring releases from Advenica, Aptori, Axonius, Broadcom, GlobalSign, Intruder, IP Fabric, Mallory, Secureframe, Siemens, Sitehop, and Virtue AI. Mallory brings contextual threat intelligence to security operations Mallory is launching an AI-native threat intelligence platform that monitors thousands of threat sources, contextualizes them against your actual attack surface, and puts that intelligence to work across hunting, detection, and exposure management use cases. One platform. … More →
The post New infosec products of the month: April 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/28092100/infosec-month-1200.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 07:00:21 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, infosec, products, the, month:, April, 2026</media:keywords>
</item>

<item>
<title>AI traffic is getting bigger, louder, and less predictable</title>
<link>https://block385.com/ai-traffic-is-getting-bigger-louder-and-less-predictable</link>
<guid>https://block385.com/ai-traffic-is-getting-bigger-louder-and-less-predictable</guid>
<description><![CDATA[ AI workflows need storage that supports repeated movement across the model lifecycle. Large datasets are ingested, transformed, exported for training, pulled back for evaluation, and refreshed as models evolve. Backblaze’s Q1 2026 Network Stats report says this creates a shift from diffuse internet-style traffic to large, high-bandwidth flows between fewer endpoints. Monthly view of all bits transferred to each network type (2025-05 to current) (Source: Backblaze) “From a network perspective, this represents a meaningful shift … More →
The post AI traffic is getting bigger, louder, and less predictable appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/09/18155333/networking.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 07:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>traffic, getting, bigger, louder, and, less, predictable</media:keywords>
</item>

<item>
<title>TeamPCP Hits SAP Packages With &amp;apos;Mini Shai&#45;Hulud&amp;apos; Attack</title>
<link>https://block385.com/teampcp-hits-sap-packages-with-mini-shai-hulud-attack</link>
<guid>https://block385.com/teampcp-hits-sap-packages-with-mini-shai-hulud-attack</guid>
<description><![CDATA[ Several npm packages for SAP&#039;s cloud application development ecosystem have been compromised as TeamPCP&#039;s supply chain attacks broaden. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt66addf126723d9f7/69f3b58b50f92923bac9ec22/sandworms_Nature_Picture_Library_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 01 May 2026 01:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TeamPCP, Hits, SAP, Packages, With, Mini, Shai-Hulud, Attack</media:keywords>
</item>

<item>
<title>Another AI&#45;Assisted Software Scan Yields 9&#45;Year&#45;Old Linux Bug</title>
<link>https://block385.com/another-ai-assisted-software-scan-yields-9-year-old-linux-bug</link>
<guid>https://block385.com/another-ai-assisted-software-scan-yields-9-year-old-linux-bug</guid>
<description><![CDATA[ The proof-of-concept exploit code runs only 10 lines long, but luckily, a patch is already available. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt7fa0185a79d14223/69f3a155cd45aa40c4f50b2e/Penguin_sign-Gareth_McCormack-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Another, AI-Assisted, Software, Scan, Yields, 9-Year-Old, Linux, Bug</media:keywords>
</item>

<item>
<title>Anthropic&amp;apos;s Mythos Has Landed: Here&amp;apos;s What Comes Next for Cyber</title>
<link>https://block385.com/anthropics-mythos-has-landed-heres-what-comes-next-for-cyber</link>
<guid>https://block385.com/anthropics-mythos-has-landed-heres-what-comes-next-for-cyber</guid>
<description><![CDATA[ In this latest installment of the Reporters&#039; Notebook video series, we discuss how the new AI model threatens to completely upend cybersecurity, and what industry leaders are telling the press. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6a494b89bd82b96f/69f3c069574eeb457137e4e8/claude1800_Ascannio_alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Anthropics, Mythos, Has, Landed:, Heres, What, Comes, Next, for, Cyber</media:keywords>
</item>

<item>
<title>PyTorch Lightning and Intercom&#45;client Hit in Supply Chain Attacks to Steal Credentials</title>
<link>https://block385.com/pytorch-lightning-and-intercom-client-hit-in-supply-chain-attacks-to-steal-credentials</link>
<guid>https://block385.com/pytorch-lightning-and-intercom-client-hit-in-supply-chain-attacks-to-steal-credentials</guid>
<description><![CDATA[ In yet another software supply chain attack, threat actors have managed to compromise the popular Python package Lightning to push two malicious versions to conduct credential theft.
According to Aikido Security, OX Security, Socket, and StepSecurity, the two malicious versions are versions 2.6.2 and 2.6.3, both of which were published on April 30, 2026. The campaign is assessed to be an ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7hiQfVCFzoPBzfr5xqJ06qMjzv-zw_qiUcDTgyEM8RbEVk3PDztg9U5Vlkgvz6j7nX8ODtXwnTCC2wB78lupEmRjcxJTz74GJGSslsMQM-e5b8vG0W2gLFnbEzYAPKw05ZelkaNfy50VyLJeb-3EhwiGKfIP9qHNRpNG4MnFUnTBBOJ95vRJb-RbcFVxX/s1600/python.png" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 22:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>PyTorch, Lightning, and, Intercom-client, Hit, Supply, Chain, Attacks, Steal, Credentials</media:keywords>
</item>

<item>
<title>PyTorch Lightning Compromised in PyPI Supply Chain Attack to Steal Credentials</title>
<link>https://block385.com/pytorch-lightning-compromised-in-pypi-supply-chain-attack-to-steal-credentials</link>
<guid>https://block385.com/pytorch-lightning-compromised-in-pypi-supply-chain-attack-to-steal-credentials</guid>
<description><![CDATA[ In yet another software supply chain attack, threat actors have managed to compromise the popular Python package Lightning to push two malicious versions to conduct credential theft.
According to Aikido Security, Socket, and StepSecurity, the two malicious versions are versions 2.6.2 and 2.6.3, both of which were published on April 30, 2026. The campaign is assessed to be an extension of the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7hiQfVCFzoPBzfr5xqJ06qMjzv-zw_qiUcDTgyEM8RbEVk3PDztg9U5Vlkgvz6j7nX8ODtXwnTCC2wB78lupEmRjcxJTz74GJGSslsMQM-e5b8vG0W2gLFnbEzYAPKw05ZelkaNfy50VyLJeb-3EhwiGKfIP9qHNRpNG4MnFUnTBBOJ95vRJb-RbcFVxX/s1600/python.png" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 20:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>PyTorch, Lightning, Compromised, PyPI, Supply, Chain, Attack, Steal, Credentials</media:keywords>
</item>

<item>
<title>Warp open sources its AI terminal client</title>
<link>https://block385.com/warp-open-sources-its-ai-terminal-client</link>
<guid>https://block385.com/warp-open-sources-its-ai-terminal-client</guid>
<description><![CDATA[ Warp, the AI-centric terminal used by close to a million developers, has released the source code for its client on GitHub under the AGPL license, with OpenAI signed on as the founding sponsor of the repository. An agent-first contribution model Warp is steering contributions through Oz, its cloud agent orchestration platform. Agents handle the bulk of implementation work, including coding, planning, and testing, and human contributors focus on ideas, direction, and verification of agent output. … More →
The post Warp open sources its AI terminal client appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/29142219/warp-open_source-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 17:00:45 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Warp, open, sources, its, terminal, client</media:keywords>
</item>

<item>
<title>Bad bots make up 40% of internet traffic</title>
<link>https://block385.com/bad-bots-make-up-40-of-internet-traffic</link>
<guid>https://block385.com/bad-bots-make-up-40-of-internet-traffic</guid>
<description><![CDATA[ The normalization of AI and automation within internet infrastructure is changing how organizations interpret traffic. Activity that once appeared anomalous is now treated as expected behavior. AI agents have emerged as a third category of automated traffic alongside good and bad bots, according to the Thales 2026 Bad Bot Report: Bad Bots in the Agentic Age. The distinction between legitimate and malicious automation is difficult to define because both operate through similar channels, workflows, and … More →
The post Bad bots make up 40% of internet traffic appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/09/23155039/bots-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 17:00:44 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bad, bots, make, 40, internet, traffic</media:keywords>
</item>

<item>
<title>Automated LLM red teaming gets a learning layer</title>
<link>https://block385.com/automated-llm-red-teaming-gets-a-learning-layer</link>
<guid>https://block385.com/automated-llm-red-teaming-gets-a-learning-layer</guid>
<description><![CDATA[ Automated red teaming of large language models has settled into a familiar pattern over the past two years. An attacker model generates jailbreak attempts against a target model, an evaluator scores the results, and the cycle repeats. Two approaches dominate. One asks the attacker to invent strategies through trial and error, which tends to produce a narrow band of successful attacks. The other, exemplified by the WildTeaming framework, draws from large open-source pools of harmful … More →
The post Automated LLM red teaming gets a learning layer appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/29113056/ai_red_teaming-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 17:00:43 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Automated, LLM, red, teaming, gets, learning, layer</media:keywords>
</item>

<item>
<title>Hackers arrested for stealing and reselling 600,000 Roblox accounts</title>
<link>https://block385.com/hackers-arrested-for-stealing-and-reselling-600000-roblox-accounts</link>
<guid>https://block385.com/hackers-arrested-for-stealing-and-reselling-600000-roblox-accounts</guid>
<description><![CDATA[ Ukrainian police detained three suspects accused of hacking into Roblox accounts and reselling the data on Russian websites, with payments made in cryptocurrency. Police raid (Source: The Prosecutor General’s Office of Ukraine) “Prosecutors of the Lviv region, together with the cyber police and the Security Service of Ukraine, have stopped the activities of a group that gained access to other people’s gaming accounts and used them as a source of income,” The Prosecutor General’s Office … More →
The post Hackers arrested for stealing and reselling 600,000 Roblox accounts appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/07/29101917/jail-prison.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 17:00:41 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hackers, arrested, for, stealing, and, reselling, 600, 000, Roblox, accounts</media:keywords>
</item>

<item>
<title>Proxmox Backup Server 4.2 arrives with S3 storage support and parallel sync jobs</title>
<link>https://block385.com/proxmox-backup-server-42-arrives-with-s3-storage-support-and-parallel-sync-jobs</link>
<guid>https://block385.com/proxmox-backup-server-42-arrives-with-s3-storage-support-and-parallel-sync-jobs</guid>
<description><![CDATA[ Proxmox Backup Server 4.2 is a maintenance and feature update built on Debian 13.4 “Trixie” that adds S3-compatible object storage as a supported backend and introduces parallel processing for sync jobs. The server ships the new version with Linux kernel 7.0 as the stable default and ZFS 2.4 for storage operations. Updated packages, broader hardware support, and security fixes accompany the kernel and filesystem changes. S3 object storage joins the supported backends S3-compatible object stores … More →
The post Proxmox Backup Server 4.2 arrives with S3 storage support and parallel sync jobs appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/22085434/proxmox-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 17:00:40 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Proxmox, Backup, Server, 4.2, arrives, with, storage, support, and, parallel, sync, jobs</media:keywords>
</item>

<item>
<title>Researchers develop tool to expose GPS signal spoofing in transit networks</title>
<link>https://block385.com/researchers-develop-tool-to-expose-gps-signal-spoofing-in-transit-networks</link>
<guid>https://block385.com/researchers-develop-tool-to-expose-gps-signal-spoofing-in-transit-networks</guid>
<description><![CDATA[ The Oak Ridge National Laboratory (ORNL) has developed a portable detector that identifies GPS spoofing in real time, including during motion, to help protect transportation systems. Spoofing involves transmitting counterfeit signals that imitate authentic GPS transmissions and produce false information about location, time, or both. GPS jamming, another form of interference, overwhelms receivers with noise and blocks legitimate satellite signals. GPS spoofing overrides real satellite signals to trick a vehicle’s positioning software into following the … More →
The post Researchers develop tool to expose GPS signal spoofing in transit networks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/04161510/trucks-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 17:00:37 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researchers, develop, tool, expose, GPS, signal, spoofing, transit, networks</media:keywords>
</item>

<item>
<title>Nine&#45;year&#45;old Linux kernel flaw enables reliable local privilege escalation (CVE&#45;2026&#45;31431)</title>
<link>https://block385.com/nine-year-old-linux-kernel-flaw-enables-reliable-local-privilege-escalation-cve-2026-31431</link>
<guid>https://block385.com/nine-year-old-linux-kernel-flaw-enables-reliable-local-privilege-escalation-cve-2026-31431</guid>
<description><![CDATA[ Security researchers at Theori have disclosed a high-severity local privilege escalation (LPE) vulnerability (CVE-2026-31431) in the Linux kernel. The flaw, nicknamed “Copy Fail”, has affected virtually every major Linux distribution shipped since 2017, and a working proof-of-concept (PoC) exploit is publicly available. About CVE-2026-31431 According to Theori researchers, CVE-2026-31431 originates from the interaction of three reasonable kernel changes made over several years: the addition of authencesn (an AEAD cryptographic wrapper used by IPsec) in 2011, … More →
The post Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/08083118/linux-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 17:00:33 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Nine-year-old, Linux, kernel, flaw, enables, reliable, local, privilege, escalation, CVE-2026-31431</media:keywords>
</item>

<item>
<title>Met Police face criticism for using AI to spy on their own officers</title>
<link>https://block385.com/met-police-face-criticism-for-using-ai-to-spy-on-their-own-officers</link>
<guid>https://block385.com/met-police-face-criticism-for-using-ai-to-spy-on-their-own-officers</guid>
<description><![CDATA[ London police officers have been warned by the Metropolitan Police Federation to watch their backs after the force deployed controversial AI software to investigate misconduct. The staff association, representing more than 30,000 officers in London, reported it had not been informed of plans to use Palantir’s AI to analyze officers’ movements. The Federation notified all colleagues and advised them to exercise “extreme caution when carrying Metropolitan Police-issued devices while off duty”. It believes the use … More →
The post Met Police face criticism for using AI to spy on their own officers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/04135518/surveillance-eye-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 17:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Met, Police, face, criticism, for, using, spy, their, own, officers</media:keywords>
</item>

<item>
<title>Cisco releases open&#45;source toolkit for verifying AI model lineage</title>
<link>https://block385.com/cisco-releases-open-source-toolkit-for-verifying-ai-model-lineage</link>
<guid>https://block385.com/cisco-releases-open-source-toolkit-for-verifying-ai-model-lineage</guid>
<description><![CDATA[ Enterprises pulling models from Hugging Face and other open repositories rarely keep records of how those models are altered after download, leaving organizations with little ability to confirm what they are running in production. The State of AI Security 2026 from Cisco places this level of access inside a growing pattern of AI-driven operations that connect directly to core business systems, and identifies AI supply chain exposure as a recurring risk. Cisco has published the … More →
The post Cisco releases open-source toolkit for verifying AI model lineage appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/29092910/ai_model_lineage.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 17:00:27 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cisco, releases, open-source, toolkit, for, verifying, model, lineage</media:keywords>
</item>

<item>
<title>cPanel zero&#45;day exploited for months before patch release (CVE&#45;2026&#45;41940)</title>
<link>https://block385.com/cpanel-zero-day-exploited-for-months-before-patch-release-cve-2026-41940</link>
<guid>https://block385.com/cpanel-zero-day-exploited-for-months-before-patch-release-cve-2026-41940</guid>
<description><![CDATA[ A critical authentication bypass vulnerability (CVE-2026-41940) in cPanel, a popular web-based control panel for managing web hosting accounts, is being exploited by attackers in the wild. What’s more, attackers didn’t have to wait for watchTowr security researchers to release technical details about the vulnerability – they have been spotted exploiting CVE-2026-41940 since February 23, and have likely been abusing it even earlier. About CVE-2026-41940 CPanel, typically provided by shared hosting companies, is one of the … More →
The post cPanel zero-day exploited for months before patch release (CVE-2026-41940) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/30141938/cpanel-1500-2.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 17:00:15 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>cPanel, zero-day, exploited, for, months, before, patch, release, CVE-2026-41940</media:keywords>
</item>

<item>
<title>Oracle Red Bull Racing Team Revs Up Automation to Boost Security</title>
<link>https://block385.com/oracle-red-bull-racing-team-revs-up-automation-to-boost-security</link>
<guid>https://block385.com/oracle-red-bull-racing-team-revs-up-automation-to-boost-security</guid>
<description><![CDATA[ While drivers race to shave off seconds on the track, the team&#039;s IT and engineering staff are speeding up how they deliver security. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt12893d714d366c26/69f2527b65fda7fdccea718b/ORBR_photos_01.JPG" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 17:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Oracle, Red, Bull, Racing, Team, Revs, Automation, Boost, Security</media:keywords>
</item>

<item>
<title>ThreatsDay Bulletin: SMS Blaster Busts, OpenEMR Flaws, 600K Roblox Hacks and 25 More Stories</title>
<link>https://block385.com/threatsday-bulletin-sms-blaster-busts-openemr-flaws-600k-roblox-hacks-and-25-more-stories</link>
<guid>https://block385.com/threatsday-bulletin-sms-blaster-busts-openemr-flaws-600k-roblox-hacks-and-25-more-stories</guid>
<description><![CDATA[ The internet is noisy this week. We are seeing some wild new tactics, like people using fake cell towers to send scam texts, while some developers are accidentally downloading tools that peek into their private files during a simple install. It is definitely a busy time to be online.
Security is always a moving target. Millions of servers are currently sitting online without any passwords, and ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwfqxUhPz38fAoq0CZr2tW8KqGW-Cr0zJloN9kS_80QO2e7yyah4N-nMKNxoSllB2tpyjKO25s2f8eFJNd2bBo50XRAVatMKnnk8ZAbRbz6kfQUhVUoD5vutOmFpYzojybY8aJZhA6KGL3sawNEyaqjlW63hAeEwrTsj8lnpou-4mThnzwCzO442aue-R0/s1600/threats.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 16:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ThreatsDay, Bulletin:, SMS, Blaster, Busts, OpenEMR, Flaws, 600K, Roblox, Hacks, and, More, Stories</media:keywords>
</item>

<item>
<title>New Python Backdoor Uses Tunneling Service to Steal Browser and Cloud Credentials</title>
<link>https://block385.com/new-python-backdoor-uses-tunneling-service-to-steal-browser-and-cloud-credentials</link>
<guid>https://block385.com/new-python-backdoor-uses-tunneling-service-to-steal-browser-and-cloud-credentials</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a stealthy Python-based backdoor framework called DEEP#DOOR that comes with capabilities to establish persistent access and harvest a wide range of sensitive information from compromised hosts.
&quot;The intrusion chain begins with execution of a batch script (&#039;install_obf.bat&#039;) that disables Windows security controls, dynamically extracts an ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnv1KtLLlZSnm9a16bN-o_szrBiAIN_QljTfe09K4RzFxSqhFADtuXmRzOPZ_Poazif-VadFAnRnboCWX5yZtc5JntGopn5Fy6T1X2BexXelFOxYtEA7qULoTCkAMwEybLf42JJ_yGjSPf_T-tjYvbqxscVgZ6OyL65yKcTjC0KQL48pgYLZUmLjxfBBhd/s1600/malware-data.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 16:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Python, Backdoor, Uses, Tunneling, Service, Steal, Browser, and, Cloud, Credentials</media:keywords>
</item>

<item>
<title>EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades</title>
<link>https://block385.com/etherrat-distribution-spoofing-administrative-tools-via-github-facades</link>
<guid>https://block385.com/etherrat-distribution-spoofing-administrative-tools-via-github-facades</guid>
<description><![CDATA[ Intro
A sophisticated, high-resilience malicious campaign was identified by Atos Threat Research Center (TRC) in March 2026. This operation specifically targets the high-privilege professional accounts of enterprise administrators, DevOps engineers, and security analysts by impersonating administrative utilities they rely on for daily operations. By integrating Search Engine Order (SEO) ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8d19xBfapc_ToA1XOK4xdQ815tfHldoYH0Cy7zsTwOoWlFNQDdubeXMv4Udo6DaFXWJK3lG4meqdmtLAuaCMfa7R1KM_EfiGE5cZItYx6NdnqjB-R_6neMFv5iIG6SjUDkRUUiZg_j7oOaueXGZb4M-K7EmJM3MCjSvgxfok9gTFNd9Qwdf-AKu_DsP4/s1600/github-2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 16:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>EtherRAT, Distribution, Spoofing, Administrative, Tools, via, GitHub, Facades</media:keywords>
</item>

<item>
<title>New Linux &amp;apos;Copy Fail&amp;apos; Vulnerability Enables Root Access on Major Distributions</title>
<link>https://block385.com/new-linux-copy-fail-vulnerability-enables-root-access-on-major-distributions</link>
<guid>https://block385.com/new-linux-copy-fail-vulnerability-enables-root-access-on-major-distributions</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a Linux local privilege escalation (LPE) flaw that could allow an unprivileged local user to obtain root.
The high-severity vulnerability tracked as CVE-2026-31431 (CVSS score: 7.8) has been codenamed Copy Fail by Xint.io and Theori.
&quot;An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYpnBkrLNj-dAKcwAbvRIvfXg8YDXoO3yfrl3vvXBOBwo2zga2asWZ0at4FLcLbiqQ1N7BsYA2szKbuqeVLBkrD80tMqYguBbqvrhEude6Fe9ayQpNs-meP8h4-f6ReWVeIU0zYp31XU7K-Kgxm5OKdI77HPQWgTx41al_WH3gYkMjEoROl6zvXF8HPRf5/s1600/root.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 12:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Linux, Copy, Fail, Vulnerability, Enables, Root, Access, Major, Distributions</media:keywords>
</item>

<item>
<title>Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution</title>
<link>https://block385.com/google-fixes-cvss-10-gemini-cli-ci-rce-and-cursor-flaws-enable-code-execution</link>
<guid>https://block385.com/google-fixes-cvss-10-gemini-cli-ci-rce-and-cursor-flaws-enable-code-execution</guid>
<description><![CDATA[ Google has addressed a maximum severity security flaw in Gemini CLI -- the &quot;@google/gemini-cli&quot; npm package and the &quot;google-github-actions/run-gemini-cli&quot; GitHub Actions workflow -- that could have allowed attackers to execute arbitrary commands on host systems.
&quot;The vulnerability allowed an unprivileged external attacker to force their own malicious content to load as Gemini configuration,&quot; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoqSVEXaseT8C79cbC1Wjec2TiF4nMK72XiCPL3WBxqwNy9iUk5CSEqSXgwJFRug0zXq5foMAXzMYCSIP0nEnr-CxCeYFgjmVcOfPtK4nocQaGDzIFecL9SScOScUhVAgGkff6wO5ks-sqWA_KCEZnfrQhfViSGai-g0MOd2IHOYX_N03JvwIipkQ1gso7/s1600/gemini-cursor.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Fixes, CVSS, Gemini, CLI, RCE, and, Cursor, Flaws, Enable, Code, Execution</media:keywords>
</item>

<item>
<title>Claude Mythos Fears Startle Japan&amp;apos;s Financial Services Sector</title>
<link>https://block385.com/claude-mythos-fears-startle-japans-financial-services-sector</link>
<guid>https://block385.com/claude-mythos-fears-startle-japans-financial-services-sector</guid>
<description><![CDATA[ Global financial institutions are panicked over Anthropic&#039;s new superhacker AI model. Cyber experts aren&#039;t quite as worried. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt12df424bcfca2d2e/69f25c31d96b17efbb20a411/Claude_Mythos-GK_Images-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 30 Apr 2026 03:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, Mythos, Fears, Startle, Japans, Financial, Services, Sector</media:keywords>
</item>

<item>
<title>AI Finds 38 Security Flaws in Electronic Health Record Platform</title>
<link>https://block385.com/ai-finds-38-security-flaws-in-electronic-health-record-platform</link>
<guid>https://block385.com/ai-finds-38-security-flaws-in-electronic-health-record-platform</guid>
<description><![CDATA[ Flaws in OpenEMR&#039;s platform — used by more than 100,000 healthcare providers — enabled database compromise, remote code execution, and data theft. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt7ca89dcf72fee586/69f255bfcd45aa3d1af505f0/ehr_pandpstock001_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 23:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Finds, Security, Flaws, Electronic, Health, Record, Platform</media:keywords>
</item>

<item>
<title>Reverse Engineering With AI Unearths High&#45;Severity GitHub Bug</title>
<link>https://block385.com/reverse-engineering-with-ai-unearths-high-severity-github-bug</link>
<guid>https://block385.com/reverse-engineering-with-ai-unearths-high-severity-github-bug</guid>
<description><![CDATA[ Wiz used an AI reverse-engineering tool to pinpoint a vulnerability that previously would have been too costly and time-consuming to undertake. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0f7f3cdef8476589/69f258736bebffd429af87fc/Android_Code_Klaus_Ohlenschlaeger_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 23:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Reverse, Engineering, With, Unearths, High-Severity, GitHub, Bug</media:keywords>
</item>

<item>
<title>SAP&#45;Related npm Packages Compromised in Credential&#45;Stealing Supply Chain Attack</title>
<link>https://block385.com/sap-related-npm-packages-compromised-in-credential-stealing-supply-chain-attack</link>
<guid>https://block385.com/sap-related-npm-packages-compromised-in-credential-stealing-supply-chain-attack</guid>
<description><![CDATA[ Cybersecurity researchers are sounding the alarm about a new supply chain attack campaign targeting SAP-related npm Packages with credential-stealing malware.
According to reports from Aikido Security, SafeDep, Socket, StepSecurity, and Google-owned Wiz, the campaign – calling itself the mini Shai-Hulud – has affected the following packages associated with SAP&#039;s JavaScript and cloud application ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7ILiV-4oJHtNRt3-K52GIsgOaNUuN9owB5ky-Mk8FvRE3QmcqDg33oV3sCrzjgWEyIUfwTtn110bcMYVU3Lp61ArknIlPAcmMvbgJJ5-WheKYivyblon2tp79ux9pJmnYNv_ShhIAA5of3Wx7QzQRZs2mNuSQs6lLG23LKMVonvElcNMy6MXp6yVZO73F/s1600/sap-npm-hacks.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 20:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SAP-Related, npm, Packages, Compromised, Credential-Stealing, Supply, Chain, Attack</media:keywords>
</item>

<item>
<title>Vect 2.0 Ransomware Acts as Wiper, Thanks to Design Error</title>
<link>https://block385.com/vect-20-ransomware-acts-as-wiper-thanks-to-design-error</link>
<guid>https://block385.com/vect-20-ransomware-acts-as-wiper-thanks-to-design-error</guid>
<description><![CDATA[ The emerging ransomware has been deployed against victims of the TeamPCP supply chain attacks, but organizations should think twice before paying for a decryptor. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6fda08080bd8b295/69f1eb99a29efb1cce4e393d/AI-agent-delete-data-vittaya_pinpan-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 19:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Vect, 2.0, Ransomware, Acts, Wiper, Thanks, Design, Error</media:keywords>
</item>

<item>
<title>SAP npm Packages Compromised by “Mini Shai&#45;Hulud” Credential&#45;Stealing Malware</title>
<link>https://block385.com/sap-npm-packages-compromised-by-mini-shai-hulud-credential-stealing-malware</link>
<guid>https://block385.com/sap-npm-packages-compromised-by-mini-shai-hulud-credential-stealing-malware</guid>
<description><![CDATA[ Cybersecurity researchers are sounding the alarm about a new supply chain attack campaign targeting SAP-related npm Packages with credential-stealing malware.
According to reports from Aikido Security, SafeDep, Socket, StepSecurity, and Google-owned Wiz, the campaign – calling itself the mini Shai-Hulud – has affected the following packages associated with SAP&#039;s JavaScript and cloud application ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoviEyxWTNHg8ARy1a-r9k4-LpHIhfCKGFL71YHc6H2v8XiyHbkvdsU26IC8jHa304gwz8zE9dXXWcL8NaA5X5KRLIWFDpxB1hjQU1af_B6uGEEr3i_RNOub2DSShyphenhyphenBXp0C3p6343TffijodxMsHVFQ-Dc9jPPApgk1uluKVP8NzUHtx1yd50YLkSw6z6G/s1600/saps.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 18:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SAP, npm, Packages, Compromised, “Mini, Shai-Hulud”, Credential-Stealing, Malware</media:keywords>
</item>

<item>
<title>New Wave of DPRK Attacks Uses AI&#45;Inserted npm Malware, Fake Firms, and RATs</title>
<link>https://block385.com/new-wave-of-dprk-attacks-uses-ai-inserted-npm-malware-fake-firms-and-rats</link>
<guid>https://block385.com/new-wave-of-dprk-attacks-uses-ai-inserted-npm-malware-fake-firms-and-rats</guid>
<description><![CDATA[ Cybersecurity researchers have discovered malicious code in an npm package after a malicious package as a dependency to the project by Anthropic&#039;s Claude Opus large language model (LLM).
The package in question is &quot;@validate-sdk/v2,&quot; which is listed on npm as a utility software development kit (SDK) for hashing, validation, encoding/decoding, and secure random generation. However, its real ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoAi4Ild7Dz2KtvraUPjGBgNHYScbOo2DzPh9iUn8IirHe8VYws7uF0A4wf2803kNMgLzCWg0oOZwXcdzRUx5-sbBPiABEN05-RtXTa2vMqOSa52E4FPELQba8QcIQBPXl6hOHuyN7cHldbTMMvxnA4UhxDk1Huh2W85I0EJeWdscqF5NdwRLjbtOXn7Zj/s1600/korean-hackers.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 18:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Wave, DPRK, Attacks, Uses, AI-Inserted, npm, Malware, Fake, Firms, and, RATs</media:keywords>
</item>

<item>
<title>Lotus Wiper Attack Targets Venezuelan Energy Firms, Utilities</title>
<link>https://block385.com/lotus-wiper-attack-targets-venezuelan-energy-firms-utilities</link>
<guid>https://block385.com/lotus-wiper-attack-targets-venezuelan-energy-firms-utilities</guid>
<description><![CDATA[ An analysis of the destructive malware reveals sophisticated living-off-the-land (LotL) techniques and detailed strategies for the widespread deletion of data. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt27befbbaecad74c3/69f124563c5d47a2fe8e421d/pdsva-oil-tanks-venezuela-JBula_62-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 17:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Lotus, Wiper, Attack, Targets, Venezuelan, Energy, Firms, Utilities</media:keywords>
</item>

<item>
<title>Webinar: How to Automate Exposure Validation to Match the Speed of AI Attacks</title>
<link>https://block385.com/webinar-how-to-automate-exposure-validation-to-match-the-speed-of-ai-attacks</link>
<guid>https://block385.com/webinar-how-to-automate-exposure-validation-to-match-the-speed-of-ai-attacks</guid>
<description><![CDATA[ In February 2026, researchers uncovered a shift that completely changed the game: threat actors are now using custom AI setups to automate attacks directly into the kill chain.
We aren&#039;t just talking about AI writing better phishing emails anymore. We’re talking about autonomous agents mapping Active Directory and seizing Domain Admin credentials in minutes.
The problem? Most defensive workflows ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8vcicU2DANrmyA4GRttWV5sb4GPYdppuZax9v279s90O_uXz10MvgxpTyOR9s-tZoccR96ph-c7hZOwXORyLBYdWEsn3zCkrT_ivf6ZVApdMY6TL6jarUO4rNjR9nfc7XPTnmc6ttcKs_9aGOsOK4RoEnliEqVYrcOtL_d7Zys-51KZosLtWtlsOX4mo/s1600/thn.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 16:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Webinar:, How, Automate, Exposure, Validation, Match, the, Speed, Attacks</media:keywords>
</item>

<item>
<title>What to Look for in an Exposure Management Platform (And What Most of Them Get Wrong)</title>
<link>https://block385.com/what-to-look-for-in-an-exposure-management-platform-and-what-most-of-them-get-wrong</link>
<guid>https://block385.com/what-to-look-for-in-an-exposure-management-platform-and-what-most-of-them-get-wrong</guid>
<description><![CDATA[ Every security team has a version of the same story. The quarter ends with hundreds of vulnerabilities closed. The dashboards are bursting with green. Then someone in a leadership meeting asks: &quot;So, are we actually safer now?&quot;
Crickets.
The room goes quiet because an honest answer requires context – which is something that patch counts and CVSS scores were never designed to provide. Exposure ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEher9s_mKSWufl-S-lAJfV_7PalFTxuPLyiublEI1g0S4mOPLkr21X8SDIXB8fo-hbUXOf07J8lXp7esCsDNp3d5lJ33kZam2mnpQWQ5jG1S56U5WyfuB12Igvk2bFrUHxlDu7z4NVom_3yHR21GMcQHCoF6MEg8oXdkm4iJcygaRtcBwoTh0Sd7umE0cph/s1600/xmcyber.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>What, Look, for, Exposure, Management, Platform, And, What, Most, Them, Get, Wrong</media:keywords>
</item>

<item>
<title>Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately</title>
<link>https://block385.com/critical-cpanel-authentication-vulnerability-identified-update-your-server-immediately</link>
<guid>https://block385.com/critical-cpanel-authentication-vulnerability-identified-update-your-server-immediately</guid>
<description><![CDATA[ cPanel has released security updates to address a security issue impacting various authentication paths that could allow an attacker to obtain access to the control panel software.
The problem affects all currently supported versions, according to an alert released by cPanel on Tuesday. The issue has been addressed in the following versions -

11.110.0.97
11.118.0.63
11.126.0.54
11.132.0.29 ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQ54sVYryCG3V_ZjHJwzuKBteLhpf8FnX131rudu9bvgYGDupWYtJHLYxGPjVON072t-CWz4hyQmxQmwIW6ZZzTXsiJhcfRHPBj1ag1H0PeFGB4KkZIAsyhR0bT_DQqCj2uf_a5Yza7VbeBd3xRIvf4VUZ8UBRM2iEY10bk3me9zotLNcLExjSMaoY3y4l/s1600/cpanel.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Critical, cPanel, Authentication, Vulnerability, Identified, —, Update, Your, Server, Immediately</media:keywords>
</item>

<item>
<title>CISA, Microsoft warn of active exploitation of Windows Shell vulnerability (CVE&#45;2026&#45;32202)</title>
<link>https://block385.com/cisa-microsoft-warn-of-active-exploitation-of-windows-shell-vulnerability-cve-2026-32202</link>
<guid>https://block385.com/cisa-microsoft-warn-of-active-exploitation-of-windows-shell-vulnerability-cve-2026-32202</guid>
<description><![CDATA[ Attackers are exploiting CVE-2026-32202, a zero-click Windows Shell spoofing vulnerability that causes victims’ systems to authenticate the attacker’s server, CISA and Microsoft have warned. About CVE-2026-32202 CVE-2026-32202 stems from an incomplete patch for CVE-2026-21510, a vulnerability that, in conjunction with CVE-2026-21513, has been exploited by APT28 (aka Fancy Bear) via weaponized LNK files that bypass Windows security features. Microsoft fixed those two flaws in February 2026, successfully preventing the initial remote code execution and SmartScreen … More →
The post CISA, Microsoft warn of active exploitation of Windows Shell vulnerability (CVE-2026-32202) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/11132343/windows-1500-1.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 13:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, Microsoft, warn, active, exploitation, Windows, Shell, vulnerability, CVE-2026-32202</media:keywords>
</item>

<item>
<title>CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV</title>
<link>https://block385.com/cisa-adds-actively-exploited-connectwise-and-windows-flaws-to-kev</link>
<guid>https://block385.com/cisa-adds-actively-exploited-connectwise-and-windows-flaws-to-kev</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two security flaws impacting ConnectWise ScreenConnect and Microsoft Windows to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The vulnerabilities are listed below -

CVE-2024-1708 (CVSS score: 8.4) - A path traversal vulnerability in  ConnectWise ScreenConnect ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifGMiUJH-3-Yk7Hnve0k2mPxHZecIbCTTN7z_CosJp8GhI7hira6707ALIDB4skUc8UbRdmWtbhz4n9fe8T-h3OGzul9awiw8DFsnsSORkjKfXr4dgEGX_ncQ7dWBYGAhyU3Efo8-z_YPCEFC_bUDH8eYeX_w6QcDrOWTnpRXqOF_IATm0t-xxMJp6uYWc/s1600/windows-logo.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 12:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, Adds, Actively, Exploited, ConnectWise, and, Windows, Flaws, KEV</media:keywords>
</item>

<item>
<title>Eino’s agentic network observability platform enables real&#45;time, AI&#45;driven network insights</title>
<link>https://block385.com/einos-agentic-network-observability-platform-enables-real-time-ai-driven-network-insights</link>
<guid>https://block385.com/einos-agentic-network-observability-platform-enables-real-time-ai-driven-network-insights</guid>
<description><![CDATA[ Eino has introduced a new class of solution for enterprises known as agentic network observability. Designed for enterprises with multiple network technologies and mission-critical use cases, Eino’s agentic solution uses a 3D digital twin approach of the physical environment to deliver real-time insights for almost any wireless networking technology, deployed together or separately. This enables enterprises, service providers, and channel partners to design, observe, and troubleshoot AI-native networks 90% faster than with existing solutions, with … More →
The post Eino’s agentic network observability platform enables real-time, AI-driven network insights appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 11:01:01 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Eino’s, agentic, network, observability, platform, enables, real-time, AI-driven, network, insights</media:keywords>
</item>

<item>
<title>Virtue AI PolicyGuard turns AI policies into enforceable runtime guardrails</title>
<link>https://block385.com/virtue-ai-policyguard-turns-ai-policies-into-enforceable-runtime-guardrails</link>
<guid>https://block385.com/virtue-ai-policyguard-turns-ai-policies-into-enforceable-runtime-guardrails</guid>
<description><![CDATA[ Virtue AI has announced PolicyGuard, a system that enables enterprises to define, edit, and enforce custom AI runtime protection guardrails across models, agents, and applications. Most organizations have “AI acceptable use policies.” When they need to enforce those policies, however, the tooling is static, fragmented, and generic: built for no industry in particular and no organization specifically. Policies vary across teams and are hard to translate into adaptive, enforceable controls. At the same time, AI … More →
The post Virtue AI PolicyGuard turns AI policies into enforceable runtime guardrails appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 11:00:59 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Virtue, PolicyGuard, turns, policies, into, enforceable, runtime, guardrails</media:keywords>
</item>

<item>
<title>amazeeClaw simplifies production deployment of AI agents with regional control</title>
<link>https://block385.com/amazeeclaw-simplifies-production-deployment-of-ai-agents-with-regional-control</link>
<guid>https://block385.com/amazeeclaw-simplifies-production-deployment-of-ai-agents-with-regional-control</guid>
<description><![CDATA[ amazee.ai has announced the launch of amazeeClaw, a managed OpenClaw hosting platform that enables developers and enterprises to deploy production-ready AI agents with data sovereignty and regional control without having to set up their own infrastructure. As adoption of AI agents and agentic automation accelerates, organizations are discovering that moving from prototype to production is harder than expected. Self-hosting OpenClaw can introduce operational complexity, security concerns, compliance hurdles, and uncertainty around data residency. amazeeClaw addresses … More →
The post amazeeClaw simplifies production deployment of AI agents with regional control appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 11:00:57 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>amazeeClaw, simplifies, production, deployment, agents, with, regional, control</media:keywords>
</item>

<item>
<title>DigitalOcean AI&#45;Native Cloud unifies infrastructure, inference, and agents for production AI</title>
<link>https://block385.com/digitalocean-ai-native-cloud-unifies-infrastructure-inference-and-agents-for-production-ai</link>
<guid>https://block385.com/digitalocean-ai-native-cloud-unifies-infrastructure-inference-and-agents-for-production-ai</guid>
<description><![CDATA[ DigitalOcean has introduced the AI-Native Cloud, an end-to-end platform built for the inference and agentic era. Spanning infrastructure, core cloud, inference, data, and managed agents, it already supports production workloads at Higgsfield AI, Hippocratic AI, ISMG, Bright Data, and LawVo. AI-native builders are caught between imperfect options: hyperscalers built for the enterprise cloud era, with complex services and unpredictable costs, and newer GPU clouds that rent bare metal and tokens, but leave teams to assemble … More →
The post DigitalOcean AI-Native Cloud unifies infrastructure, inference, and agents for production AI appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 11:00:52 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DigitalOcean, AI-Native, Cloud, unifies, infrastructure, inference, and, agents, for, production</media:keywords>
</item>

<item>
<title>Kaseya agentic IT management unifies data and automates ticketing, security and backups</title>
<link>https://block385.com/kaseya-agentic-it-management-unifies-data-and-automates-ticketing-security-and-backups</link>
<guid>https://block385.com/kaseya-agentic-it-management-unifies-data-and-automates-ticketing-security-and-backups</guid>
<description><![CDATA[ Kaseya has introduced an agentic IT management platform powered by Kaseya Intelligence, combining unified data across IT operations, cybersecurity, and resilience with an execution layer that autonomously triages tickets, contains threats, verifies backups, and optimizes workflows. This is the core architectural difference. Every major vendor has added AI, but when it runs on partial data and disconnected tools, it often produces inaccurate recommendations that create more work, not less. Kaseya unifies data across endpoints, help … More →
The post Kaseya agentic IT management unifies data and automates ticketing, security and backups appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 11:00:40 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Kaseya, agentic, management, unifies, data, and, automates, ticketing, security, and, backups</media:keywords>
</item>

<item>
<title>Microchip expands Trust Shield with PQC&#45;ready root of trust and secure boot controllers</title>
<link>https://block385.com/microchip-expands-trust-shield-with-pqc-ready-root-of-trust-and-secure-boot-controllers</link>
<guid>https://block385.com/microchip-expands-trust-shield-with-pqc-ready-root-of-trust-and-secure-boot-controllers</guid>
<description><![CDATA[ Microchip Technology is expanding its portfolio of Trust Shield, PQC‑ready devices with the TS1800 Platform Root of Trust controller and the TS50x secure boot controller. The devices are designed to help system architects address emerging cybersecurity mandates, including the European Cyber Resilience Act (CRA) and Commercial National Security Algorithm Suite 2.0 (CNSA 2.0), while supporting evolving data center, compute, defense, telecommunication and infrastructure security standards. The TS1800 integrated circuit (IC) functions as an external Platform … More →
The post Microchip expands Trust Shield with PQC-ready root of trust and secure boot controllers appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 11:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microchip, expands, Trust, Shield, with, PQC-ready, root, trust, and, secure, boot, controllers</media:keywords>
</item>

<item>
<title>AI prompt confidentiality and false citations worry researchers</title>
<link>https://block385.com/ai-prompt-confidentiality-and-false-citations-worry-researchers</link>
<guid>https://block385.com/ai-prompt-confidentiality-and-false-citations-worry-researchers</guid>
<description><![CDATA[ Academic researchers using commercial AI tools for literature review and idea generation are sending unpublished research questions, draft hypotheses, and proprietary domain knowledge into systems whose data handling they do not understand. A think-aloud study of 15 researchers documents the workarounds these users have built to manage what they see as unresolved confidentiality and output verification problems in tools including Research Rabbit and Elicit AI. The study, conducted by researchers at the University of Texas … More →
The post AI prompt confidentiality and false citations worry researchers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/28151614/inspect-search.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 09:00:39 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>prompt, confidentiality, and, false, citations, worry, researchers</media:keywords>
</item>

<item>
<title>The Exchange Online security controls organizations keep getting wrong</title>
<link>https://block385.com/the-exchange-online-security-controls-organizations-keep-getting-wrong</link>
<guid>https://block385.com/the-exchange-online-security-controls-organizations-keep-getting-wrong</guid>
<description><![CDATA[ In this Help Net Security interview, Scott Schnoll, Microsoft MVP for Exchange, breaks down the Shared Responsibility Model, where Microsoft secures the cloud while organizations must protect their own data, identities, and configurations. The discussion covers default settings worth changing tomorrow, including legacy protocols like SMTP AUTH that survive due to printer, scanner, and ERP dependencies. Schnoll highlights overlooked controls such as Conditional Access, PIM, and continuous monitoring, plus blind spots in audit logs around … More →
The post The Exchange Online security controls organizations keep getting wrong appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/28073934/scott_schnoll-2-microsoft.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 09:00:21 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Exchange, Online, security, controls, organizations, keep, getting, wrong</media:keywords>
</item>

<item>
<title>Fedora Linux 44 ships with GNOME 50 and KDE Plasma 6.6</title>
<link>https://block385.com/fedora-linux-44-ships-with-gnome-50-and-kde-plasma-66</link>
<guid>https://block385.com/fedora-linux-44-ships-with-gnome-50-and-kde-plasma-66</guid>
<description><![CDATA[ The Fedora Project released Fedora Linux 44, delivering updated desktop environments, revised installer behavior, and several lower-level system changes across its editions and spins. The release covers the project’s flagship editions, including Workstation, KDE Plasma Desktop, Cloud, Server, CoreOS, and IoT, alongside the Atomic Desktops lineup of Silverblue, Kinoite, Cosmic, Budgie, and Sway. Alternate spins such as Cinnamon and Xfce are also available. Desktop updates Fedora Workstation 44 ships with GNOME 50, which brings refinements … More →
The post Fedora Linux 44 ships with GNOME 50 and KDE Plasma 6.6 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/29084706/fedora-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 09:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fedora, Linux, ships, with, GNOME, and, KDE, Plasma, 6.6</media:keywords>
</item>

<item>
<title>LiteLLM CVE&#45;2026&#45;42208 SQL Injection Exploited within 36 Hours of Disclosure</title>
<link>https://block385.com/litellm-cve-2026-42208-sql-injection-exploited-within-36-hours-of-disclosure</link>
<guid>https://block385.com/litellm-cve-2026-42208-sql-injection-exploited-within-36-hours-of-disclosure</guid>
<description><![CDATA[ In yet another instance of threat actors quickly jumping on the exploitation bandwagon, a newly disclosed critical security flaw in BerriAI&#039;s LiteLLM Python package has come under active exploitation in the wild within 36 hours of the bug becoming public knowledge.
The vulnerability, tracked as CVE-2026-42208 (CVSS score: 9.3), is an SQL injection that could be exploited to modify the underlying ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgev8o8oELGzruYVoLF6t_fn8gZnmWpTXq4Xgoq5n4Tc1H4qmyLdYJ53-8pGelRL4BrBtZqpCCsSgo_He2ItCULVwwPIgOHuN6S6zn5s9RYFASTpWxIoX8vlPmigRngBNb0ucFElbHxiz8uPWa2OkasjaBTQAG8hqeHqi_llW4WMI_gIZHjx23jm-O3ccQx/s1600/lite.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 08:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>LiteLLM, CVE-2026-42208, SQL, Injection, Exploited, within, Hours, Disclosure</media:keywords>
</item>

<item>
<title>Product showcase: SimpleX Chat removes user identifiers from messaging</title>
<link>https://block385.com/product-showcase-simplex-chat-removes-user-identifiers-from-messaging</link>
<guid>https://block385.com/product-showcase-simplex-chat-removes-user-identifiers-from-messaging</guid>
<description><![CDATA[ SimpleX Chat is a free, private, open-source messenger that uses encryption and does not require user identifiers. It is available on mobile and desktop platforms, including iOS, Android, Windows, macOS, and Linux. After downloading the app, the user creates a profile by entering a display name. The profile is stored locally on the device. After setup, the app prompts users to choose a notification mode. On first use, it also asks them to enable system … More →
The post Product showcase: SimpleX Chat removes user identifiers from messaging appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/28081226/simplex-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 07:00:25 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Product, showcase:, SimpleX, Chat, removes, user, identifiers, from, messaging</media:keywords>
</item>

<item>
<title>Identity discovery: The overlooked lever in strategic risk reduction</title>
<link>https://block385.com/identity-discovery-the-overlooked-lever-in-strategic-risk-reduction</link>
<guid>https://block385.com/identity-discovery-the-overlooked-lever-in-strategic-risk-reduction</guid>
<description><![CDATA[ If you ask a CISO what keeps them up at night, the answer usually isn’t “lack of tools.” It’s uncertainty. Uncertainty about what they don’t see. Uncertainty about how far an attacker could move once inside. Uncertainty about whether identity programs are actually reducing risk, or just managing symptoms. Identity discovery sits at the center of that uncertainty. It is not glamorous. It does not get the same attention as AI-driven detection or zero trust … More →
The post Identity discovery: The overlooked lever in strategic risk reduction appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/09/16094152/identity-person.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 07:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Identity, discovery:, The, overlooked, lever, strategic, risk, reduction</media:keywords>
</item>

<item>
<title>Canada’s first SMS blaster case leads to three arrests</title>
<link>https://block385.com/canadas-first-sms-blaster-case-leads-to-three-arrests</link>
<guid>https://block385.com/canadas-first-sms-blaster-case-leads-to-three-arrests</guid>
<description><![CDATA[ Canadian law enforcement arrested three men who face 44 charges for operating an SMS blaster device that mimicked a legitimate cellular tower. The device was operated from vehicles, allowing it to move throughout the Greater Toronto Area and operate in multiple locations. When a phone connects to an SMS blaster, the user receives fraudulent text messages that appear to come from trusted organizations. These messages often prompt recipients to click on links leading to fake … More →
The post Canada’s first SMS blaster case leads to three arrests appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/01/20132222/arrest-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 03:00:44 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Canada’s, first, SMS, blaster, case, leads, three, arrests</media:keywords>
</item>

<item>
<title>US state privacy fines reached $3.425 billion in 2025</title>
<link>https://block385.com/us-state-privacy-fines-reached-3425-billion-in-2025</link>
<guid>https://block385.com/us-state-privacy-fines-reached-3425-billion-in-2025</guid>
<description><![CDATA[ State privacy regulators across the United States collected $3.425 billion in privacy-related fines from companies in 2025. Gartner said the upward trend is expected to accelerate through 2028. Annual cumulative fines stood at $1.827 billion in 2024, putting the 2025 result at nearly double the previous year’s level. Gartner derived the estimate by compiling and aggregating enforcement actions and statutory private rights of action tied to state and federal privacy laws. A turning point for … More →
The post US state privacy fines reached $3.425 billion in 2025 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/12/14144300/eye-privacy-internet-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 03:00:41 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>state, privacy, fines, reached, 3.425, billion, 2025</media:keywords>
</item>

<item>
<title>The metrics killing your SOC, and what to use instead</title>
<link>https://block385.com/the-metrics-killing-your-soc-and-what-to-use-instead</link>
<guid>https://block385.com/the-metrics-killing-your-soc-and-what-to-use-instead</guid>
<description><![CDATA[ Security operations centres risk being rendered entirely ineffective if organizations measure them using the wrong performance indicators, according to Dave Chismon, CTO for Architecture at UK’s National Cyber Security Centre. Ticket-based metrics miss the point Evaluating ones’ SOC using the same ticket-based metrics applied to IT service desks can actively work against its core purpose: detecting and responding to real attacks. The problem, Chismon explains, is one of perverse incentives: When SOC analysts are measured … More →
The post The metrics killing your SOC, and what to use instead appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/28141458/security-operations.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 03:00:40 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, metrics, killing, your, SOC, and, what, use, instead</media:keywords>
</item>

<item>
<title>NowSecure MARI gives enterprises evidence&#45;based visibility into third&#45;party mobile app risk</title>
<link>https://block385.com/nowsecure-mari-gives-enterprises-evidence-based-visibility-into-third-party-mobile-app-risk</link>
<guid>https://block385.com/nowsecure-mari-gives-enterprises-evidence-based-visibility-into-third-party-mobile-app-risk</guid>
<description><![CDATA[ NowSecure has announced Mobile App Risk Intelligence (MARI), new capabilities that give enterprises evidence-based visibility into third-party mobile apps, as hidden AI features, opaque code, and unseen data flows create a growing governance gap. Employees are adopting mobile apps faster than security teams can evaluate them, and many of those apps now include AI components, third-party services and cross-border data flows that conventional review methods often fail to detect before risk is introduced. MARI addresses … More →
The post NowSecure MARI gives enterprises evidence-based visibility into third-party mobile app risk appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 03:00:39 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NowSecure, MARI, gives, enterprises, evidence-based, visibility, into, third-party, mobile, app, risk</media:keywords>
</item>

<item>
<title>Cequence Agent Personas bring granular control and governance to enterprise AI agents</title>
<link>https://block385.com/cequence-agent-personas-bring-granular-control-and-governance-to-enterprise-ai-agents</link>
<guid>https://block385.com/cequence-agent-personas-bring-granular-control-and-governance-to-enterprise-ai-agents</guid>
<description><![CDATA[ Cequence Security has announced the general availability of Agent Personas in Cequence AI Gateway. These capabilities give enterprises granular, infrastructure-level control over what AI agents can do, down to individual tool calls, closing a critical privilege gap that identity alone cannot address. As organizations deploy AI agents to connect to enterprise applications via the Model Context Protocol (MCP), a dangerous assumption has taken hold: that authenticating who an agent is amounts to controlling what it … More →
The post Cequence Agent Personas bring granular control and governance to enterprise AI agents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 03:00:38 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cequence, Agent, Personas, bring, granular, control, and, governance, enterprise, agents</media:keywords>
</item>

<item>
<title>Alleged Chinese hacker extradited to US over cyberattacks targeting COVID&#45;19 research</title>
<link>https://block385.com/alleged-chinese-hacker-extradited-to-us-over-cyberattacks-targeting-covid-19-research</link>
<guid>https://block385.com/alleged-chinese-hacker-extradited-to-us-over-cyberattacks-targeting-covid-19-research</guid>
<description><![CDATA[ Chinese national Xu Zewei was extradited from Italy to the United States to face charges tied to an alleged cyber espionage campaign that breached thousands of computers worldwide. Xu is charged alongside Zhang Yu, who remains at large. According to court documents, officers of China’s Ministry of State Security (MSS), including its Shanghai State Security Bureau (SSSB), directed the hacking. Xu allegedly carried out the intrusions while working for Shanghai Powerock Network Co. Ltd., a … More →
The post Alleged Chinese hacker extradited to US over cyberattacks targeting COVID-19 research appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22102933/sentence-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 03:00:37 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Alleged, Chinese, hacker, extradited, over, cyberattacks, targeting, COVID-19, research</media:keywords>
</item>

<item>
<title>Sevii unveils Cyber Swarm Defense Mode to stop AI&#45;driven attacks at scale</title>
<link>https://block385.com/sevii-unveils-cyber-swarm-defense-mode-to-stop-ai-driven-attacks-at-scale</link>
<guid>https://block385.com/sevii-unveils-cyber-swarm-defense-mode-to-stop-ai-driven-attacks-at-scale</guid>
<description><![CDATA[ Sevii has unveiled a new capability designed to stop high-volume, AI-powered cyberattacks at machine speed and scale, without the burden of unpredictable AI token costs. Sevii’s Cyber Swarm Defense Mode (CSD) addresses a critical gap created by AI, namely the inability to sustain cyber performance and cost efficiency during large-scale, AI-driven attack swarms. As technologies like Mythos expand attack surfaces and compress the window between vulnerability discovery and exploitation, legacy security tools struggle to keep … More →
The post Sevii unveils Cyber Swarm Defense Mode to stop AI-driven attacks at scale appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 03:00:35 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Sevii, unveils, Cyber, Swarm, Defense, Mode, stop, AI-driven, attacks, scale</media:keywords>
</item>

<item>
<title>ShinyHunters claims it stole 1.4 million records from Udemy</title>
<link>https://block385.com/shinyhunters-claims-it-stole-14-million-records-from-udemy</link>
<guid>https://block385.com/shinyhunters-claims-it-stole-14-million-records-from-udemy</guid>
<description><![CDATA[ The ShinyHunters group claims it has breached the Udemy, one of the world’s largest online learning platforms. According to Have I Been Pwned, the leaked dataset contained 1.4 million unique email addresses of customers and instructors, along with names, physical addresses, phone numbers, employer information, and instructor payout methods, including PayPal, cheque, and bank transfer. “Over 1.4M records containing PII and other internal corporate data have been compromised. Pay or Leak,” ShinyHunters wrote on their … More →
The post ShinyHunters claims it stole 1.4 million records from Udemy appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/28155912/udemy-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 03:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ShinyHunters, claims, stole, 1.4, million, records, from, Udemy</media:keywords>
</item>

<item>
<title>Police arrest 10 suspected members of Black Axe cybercrime gang</title>
<link>https://block385.com/police-arrest-10-suspected-members-of-black-axe-cybercrime-gang</link>
<guid>https://block385.com/police-arrest-10-suspected-members-of-black-axe-cybercrime-gang</guid>
<description><![CDATA[ A coordinated police operation in Switzerland has targeted suspected members of the Black Axe criminal network. On 28 April 2026, authorities carried out house searches across several Swiss cantons, leading to 10 arrests, including the Black Axe ‘Regional Head’ for Southern Europe. Most of those arrested are reported to be of Nigerian origin. The suspects are accused of numerous crimes, including romance scams, other cyber fraud offences causing millions of Swiss francs in damages, and … More →
The post Police arrest 10 suspected members of Black Axe cybercrime gang appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/28154436/sentence-court5-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 03:00:20 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Police, arrest, suspected, members, Black, Axe, cybercrime, gang</media:keywords>
</item>

<item>
<title>FIDO Alliance wants to keep AI agents from going rogue on online payments</title>
<link>https://block385.com/fido-alliance-wants-to-keep-ai-agents-from-going-rogue-on-online-payments</link>
<guid>https://block385.com/fido-alliance-wants-to-keep-ai-agents-from-going-rogue-on-online-payments</guid>
<description><![CDATA[ AI agents are beginning to shop, log in, and complete tasks with little direct input. That shift is pushing the security industry to rethink how trust works when actions are carried out on a user’s behalf. The FIDO Alliance has announced a set of initiatives to build shared standards for these interactions, covering how AI agents authenticate, follow instructions, and carry out transactions. “AI agents are quickly becoming part of how people get things done … More →
The post FIDO Alliance wants to keep AI agents from going rogue on online payments appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/28155547/fido-alliance-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 03:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>FIDO, Alliance, wants, keep, agents, from, going, rogue, online, payments</media:keywords>
</item>

<item>
<title>BlueNoroff Uses Fake Zoom Calls to Turn Victims Into Attack Lures</title>
<link>https://block385.com/bluenoroff-uses-fake-zoom-calls-to-turn-victims-into-attack-lures</link>
<guid>https://block385.com/bluenoroff-uses-fake-zoom-calls-to-turn-victims-into-attack-lures</guid>
<description><![CDATA[ The North Korean group is using stolen victim videos, AI-generated avatars, and fake Zoom calls to scale malware attacks against cryptocurrency executives. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0143cb21f34c0ad9/69f11ed6518c911d5067bb51/deepfake_Smile_Studio_AP_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 01:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>BlueNoroff, Uses, Fake, Zoom, Calls, Turn, Victims, Into, Attack, Lures</media:keywords>
</item>

<item>
<title>NSA Chief During Snowden Affair Shares Regrets, Reflections 13 Years Later</title>
<link>https://block385.com/nsa-chief-during-snowden-affair-shares-regrets-reflections-13-years-later</link>
<guid>https://block385.com/nsa-chief-during-snowden-affair-shares-regrets-reflections-13-years-later</guid>
<description><![CDATA[ Chris Inglis was the head civilian in charge at the NSA when the Snowden leak exploded. He gets candid about mistakes the organization made, and what CISOs need to know about spotting potential threats, media disclosures, and &quot;enculturation.&quot; ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0469f94bd17817ff/6642699959fdc64aa5f9c5fa/dark-reading-confidential-logo-sq.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 29 Apr 2026 01:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NSA, Chief, During, Snowden, Affair, Shares, Regrets, Reflections, Years, Later</media:keywords>
</item>

<item>
<title>Vidar Rises to Top of Chaotic Infostealer Market</title>
<link>https://block385.com/vidar-rises-to-top-of-chaotic-infostealer-market</link>
<guid>https://block385.com/vidar-rises-to-top-of-chaotic-infostealer-market</guid>
<description><![CDATA[ The malware has filled the gap created by last year&#039;s law enforcement takedowns of Lumma and Rhadamanthys. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3a291e1dc97034df/69efcf5bd9eb8a77ca3cb9e9/infostealer_Bits_And_Splits_shutterstok.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 28 Apr 2026 23:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Vidar, Rises, Top, Chaotic, Infostealer, Market</media:keywords>
</item>

<item>
<title>Feuding Ransomware Groups Leak Each Other&amp;apos;s Data</title>
<link>https://block385.com/feuding-ransomware-groups-leak-each-others-data</link>
<guid>https://block385.com/feuding-ransomware-groups-leak-each-others-data</guid>
<description><![CDATA[ When 0APT and KryBit attacked each other, they exposed infrastructure and operational data, giving defenders rare insight into ransomware operations. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltbccf743048a8212d/69f10b44d85d6ebcc789c1d4/Hackers_hacking_hackers_Sergio_Azenha_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 28 Apr 2026 23:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Feuding, Ransomware, Groups, Leak, Each, Others, Data</media:keywords>
</item>

<item>
<title>Researchers Discover Critical GitHub CVE&#45;2026&#45;3854 RCE Flaw Exploitable via Single Git Push</title>
<link>https://block385.com/researchers-discover-critical-github-cve-2026-3854-rce-flaw-exploitable-via-single-git-push</link>
<guid>https://block385.com/researchers-discover-critical-github-cve-2026-3854-rce-flaw-exploitable-via-single-git-push</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a critical security vulnerability impacting GitHub.com and GitHub Enterprise Server that could allow an authenticated user to obtain remote code execution with a single &quot;git push&quot; command.
The flaw, tracked as CVE-2026-3854 (CVSS score: 8.7), is a case of command injection that could allow an attacker with push access to a repository to achieve ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgztlzahKA2HwUQiNDerhbX2l415JinNIW5jaU5tgskPVHqpMhba_NorYL9SSWRzLdSPjSnsxZKQic97f8H2Bx2G0Dsjb58dcdFuZoL0c5Gno3BVvYa4vi62_PNr1Qh-kBYED7YbTPw3fqQklMmnoPV0b1KYaienKHzIAtBuktMqyVCxGU0u8Hkd-zzYeNU/s1600/github.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 28 Apr 2026 22:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researchers, Discover, Critical, GitHub, CVE-2026-3854, RCE, Flaw, Exploitable, via, Single, Git, Push</media:keywords>
</item>

<item>
<title>Brazilian LofyGang Resurfaces After Three Years With Minecraft LofyStealer Campaign</title>
<link>https://block385.com/brazilian-lofygang-resurfaces-after-three-years-with-minecraft-lofystealer-campaign</link>
<guid>https://block385.com/brazilian-lofygang-resurfaces-after-three-years-with-minecraft-lofystealer-campaign</guid>
<description><![CDATA[ A cybercrime group of Brazilian origin has resurfaced after more than three years to orchestrate a campaign that targets Minecraft players with a new stealer called LofyStealer (aka GrabBot).
&quot;The malware disguises itself as a Minecraft hack called &#039;Slinky,&#039;&quot; Brazil-based cybersecurity company ZenoX said in a technical report. &quot;It uses the official game icon to induce voluntary execution, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQf8Wzg1Ms0KVsO546uQuwlR3w_8qW1MQZExs5TgKCGHSNNS1UEnOITq-_y8HIrA_3n_gfq7Hm0IMb-XSRJSsGL1ncRPlPoyDX7cf_wFbEGAJCPkv6ZDBzjN1Nswe9-CMR3Tmn1F5KuVyWGdOkGEIbeI9R7zGKplJPofRFBx-Ru20JOGfAFEpiZOAlDBXh/s1600/hackers.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 28 Apr 2026 20:30:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Brazilian, LofyGang, Resurfaces, After, Three, Years, With, Minecraft, LofyStealer, Campaign</media:keywords>
</item>

<item>
<title>Fresh Wave of GlassWorm VS Code Extensions Slices Through Supply Chain</title>
<link>https://block385.com/fresh-wave-of-glassworm-vs-code-extensions-slices-through-supply-chain</link>
<guid>https://block385.com/fresh-wave-of-glassworm-vs-code-extensions-slices-through-supply-chain</guid>
<description><![CDATA[ Attackers continue to scale a campaign to seed Open VSX with seemingly benign VS Code extensions that spread self-propagating malware. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt29f294da498da1a6/69b85a4f06fbf45feebd0234/Gummy_Worms_Clear_Brent_Hofacker_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 28 Apr 2026 19:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fresh, Wave, GlassWorm, Code, Extensions, Slices, Through, Supply, Chain</media:keywords>
</item>

<item>
<title>Why Secure Data Movement Is the Zero Trust Bottleneck Nobody Talks About</title>
<link>https://block385.com/why-secure-data-movement-is-the-zero-trust-bottleneck-nobody-talks-about</link>
<guid>https://block385.com/why-secure-data-movement-is-the-zero-trust-bottleneck-nobody-talks-about</guid>
<description><![CDATA[ Every security program is betting on the same assumption: once a system is connected, the problem is solved. Open a ticket, stand up a gateway, push the data through. Done.
That assumption is wrong. It is also a major reason Zero Trust programs stall.
New research my team just published puts numbers on it. The Cyber360: Defending the Digital Battlespace report, based on a survey of 500 security ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrVD0Q_dTvO3tooHYWKp7i_lkLd6h30GSv_DDv4jIb_KZDY5heV39R01GFN6MWEq1JsilHFrd7EtDOBkmlkvXYAb7-w51A1SDN3AAiEAbuq7ZnNREakyHouZPVBMNhk_HnEOK8D7H5m51A2zcUvAvDjmPnrrzeZI_nQHFao1QbljV4ortyzuqbXsNR35c/s1600/everfox.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 28 Apr 2026 16:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, Secure, Data, Movement, the, Zero, Trust, Bottleneck, Nobody, Talks, About</media:keywords>
</item>

<item>
<title>VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB on Windows, Linux, ESXi</title>
<link>https://block385.com/vect-20-ransomware-irreversibly-destroys-files-over-131kb-on-windows-linux-esxi</link>
<guid>https://block385.com/vect-20-ransomware-irreversibly-destroys-files-over-131kb-on-windows-linux-esxi</guid>
<description><![CDATA[ Threat hunters are warning that the cybercriminal operation known as VECT 2.0 acts more like a wiper than a ransomware due to a critical flaw in its encryption implementation across Windows, Linux, and ESXi variants that renders recovery impossible even for the threat actors.
The fact that VECT&#039;s locker permanently destroys large files rather than encrypting them means even victims who opt to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEji1Auw0eR5oiVkEiB8JPzjSCaFsUUiAOfNHrcsOzO4DElBB4gbQ20uu3p69nojIkLsgxZOj81fa7fK_dchUAx0WINAGMq3X0VSA7LH_Isc1hPAvls76rdLeSYCn40zw8P2xAikVwxb_pclaNQXER8G7nzPO41LAl0-ELu-i60_RLl7CLCWcC9gGrEC8oXw/s1600/vect.gif" length="49398" type="image/jpeg"/>
<pubDate>Tue, 28 Apr 2026 16:30:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>VECT, 2.0, Ransomware, Irreversibly, Destroys, Files, Over, 131KB, Windows, Linux, ESXi</media:keywords>
</item>

<item>
<title>Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE</title>
<link>https://block385.com/critical-unpatched-flaw-leaves-hugging-face-lerobot-open-to-unauthenticated-rce</link>
<guid>https://block385.com/critical-unpatched-flaw-leaves-hugging-face-lerobot-open-to-unauthenticated-rce</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a critical security flaw impacting LeRobot, Hugging Face&#039;s open-source robotics platform with nearly 24,000 GitHub stars, that could be exploited to achieve remote code execution.
The vulnerability in question is CVE-2026-25874 (CVSS score: 9.3), which has been described as a case of untrusted data deserialization stemming from the use of the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_yhcF_ELr7WEtcfHJTj6KXaci5hMzJMQzWlKpRwmiUDUDlRiLn5kZFpj4JkLxrqw0JBajNTAmlAxzIkQytW333ZnGJBKeGY-rBsLLrCPqATNkq3TvcBRbi61oogxsv5Z1a2REm5g7cpgfqKq_fnr2B1O1tPHDckGGiBA7YZY0Jcl7nWIzqaDYFGqEm3nZ/s1600/lerobots.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 28 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Critical, Unpatched, Flaw, Leaves, Hugging, Face, LeRobot, Open, Unauthenticated, RCE</media:keywords>
</item>

<item>
<title>After Mythos: New Playbooks For a Zero&#45;Window Era</title>
<link>https://block385.com/after-mythos-new-playbooks-for-a-zero-window-era</link>
<guid>https://block385.com/after-mythos-new-playbooks-for-a-zero-window-era</guid>
<description><![CDATA[ When patching isn’t fast enough, NDR helps contain the next era of threats.
If you’ve been tracking advancements in AI, you know the exploit window, the short buffer that organizations relied on to patch and protect after a vulnerability disclosure, is closing fast.
Anthropic’s new model, Claude Mythos, and its Project Glasswing, showed that finding exploitable vulnerabilities and subtle cracks ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzc6SWl21t5zRKK4OvMIg-ZtrnsRwKm8E3dglWBxBpyC_vXdsbGazi1uRcQagObPghUhK33RtvJOFEZ5-W7jCVBV36HOC-iepqOkjgHuvAHkmeoKRvMw-IJ7Cq8KUV5iBwVg-1yLJ7XmTGLab6a4ECZ11eGP8lCOLORbJcng1onSTv_L2aDYHSVmNCMjw/s1600/corelight.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 28 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>After, Mythos:, New, Playbooks, For, Zero-Window, Era</media:keywords>
</item>

<item>
<title>Chinese Silk Typhoon Hacker Extradited to U.S. Over COVID Research Cyberattacks</title>
<link>https://block385.com/chinese-silk-typhoon-hacker-extradited-to-us-over-covid-research-cyberattacks</link>
<guid>https://block385.com/chinese-silk-typhoon-hacker-extradited-to-us-over-covid-research-cyberattacks</guid>
<description><![CDATA[ A Chinese national accused of being a member of the Silk Typhoon hacking group has been extradited to the U.S. from Italy. 
Xu Zewei, 34, was arrested in July 2025 by Italian authorities for his alleged links to the Chinese state-sponsored threat group and for orchestrating cyber attacks against American organizations and government agencies between February 2020 and June 2021, including ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtGdvCIS6jOvz5WvlLwD34DqwHSyM4DaERfLDinlvQ4UfRqBUsjPp3o-sOVZL-gfqCHrsz53BMM3-fdFlaCLtMLshTfU9ncVM4qqkF9dzjsi9sF8XdMlbXvJSpDUSXdP_h4KN01TbwhT-10z626gUmlgrE4MlyM5lBTmZDKkB-g-xoMVgDFmM0b5sCCzQr/s1600/covid-hacker.png" length="49398" type="image/jpeg"/>
<pubDate>Tue, 28 Apr 2026 12:30:14 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Chinese, Silk, Typhoon, Hacker, Extradited, U.S., Over, COVID, Research, Cyberattacks</media:keywords>
</item>

<item>
<title>Microsoft Patches Entra ID Role Flaw That Enabled Service Principal Takeover</title>
<link>https://block385.com/microsoft-patches-entra-id-role-flaw-that-enabled-service-principal-takeover</link>
<guid>https://block385.com/microsoft-patches-entra-id-role-flaw-that-enabled-service-principal-takeover</guid>
<description><![CDATA[ An administrative role meant for artificial intelligence (AI) agents within Microsoft Entra ID could enable privilege escalation and identity takeover attacks, according to new findings from Silverfort.
Agent ID Administrator is a privileged built-in role introduced by Microsoft as part of its agent identity platform to handle all aspects of an AI agent&#039;s identity lifecycle operations in a ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4YomH2AGnUSAePfyyvEMXCbULukirvclzEJ6gnsm30Y2PApuarWfCLpKrBng3qYhhINWPwn99rVtdqKcEtbnVR9jkXkpBY-vDByDzMmZgLPPPrqyodmgqBCfR3ojF1tbyaFHQxIdr8voZgDugagnBymAchRR99uUm_0btEdWYeir8B6njw6Q1lPTcugcB/s1600/azure.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 28 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Patches, Entra, Role, Flaw, That, Enabled, Service, Principal, Takeover</media:keywords>
</item>

<item>
<title>Microsoft Confirms Active Exploitation of Windows Shell CVE&#45;2026&#45;32202</title>
<link>https://block385.com/microsoft-confirms-active-exploitation-of-windows-shell-cve-2026-32202</link>
<guid>https://block385.com/microsoft-confirms-active-exploitation-of-windows-shell-cve-2026-32202</guid>
<description><![CDATA[ Microsoft on Monday revised its advisory for a now-patched, high-severity security flaw impacting Windows Shell to acknowledge that it has been actively exploited in the wild.
The vulnerability in question is CVE-2026-32202 (CVSS score: 4.3), a spoofing vulnerability that could allow an attacker to access sensitive information. It was addressed as part of its Patch Tuesday update for this ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiMPU-2lLUg__kJUnPm1HSRP0cTelgKBaXgKDq4ODhX0XTKI83sddz2F_EHiOmoxnTYIkIFYIbFh8JLAMp6lqfK39czq_e1G5Ixe-Y53_-kXBSk0fqVZV6jFpECe1JjAy3ZD3MmnJ71jpZHuPpbNRjB4x7SsmfHNUCMVyzQiST7CTc9m3qteMc4zJ2U_GXo/s1600/windows-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 28 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Confirms, Active, Exploitation, Windows, Shell, CVE-2026-32202</media:keywords>
</item>

<item>
<title>UNC6692 Combines Social Engineering, Malware, Cloud Abuse</title>
<link>https://block385.com/unc6692-combines-social-engineering-malware-cloud-abuse</link>
<guid>https://block385.com/unc6692-combines-social-engineering-malware-cloud-abuse</guid>
<description><![CDATA[ A newly discovered threat actor is using Microsoft Teams, AWS S3 buckets, and custom &quot;Snow&quot; malware in a multipronged campaign. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltefbf4a39ab640f97/69efb7451d99c5d0f25b7d66/snowy_ski_resort_Marc_Muench_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 23:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>UNC6692, Combines, Social, Engineering, Malware, Cloud, Abuse</media:keywords>
</item>

<item>
<title>Unpatched &amp;apos;PhantomRPC&amp;apos; Flaw in Windows Enables Privilege Escalation</title>
<link>https://block385.com/unpatched-phantomrpc-flaw-in-windows-enables-privilege-escalation</link>
<guid>https://block385.com/unpatched-phantomrpc-flaw-in-windows-enables-privilege-escalation</guid>
<description><![CDATA[ A researcher discovered five different exploit paths that stem from an architectural weakness in how Windows&#039; Remote Procedure Call (RPC) mechanism handles connections to unavailable services. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt7ddc6c26fd6a3096/69ef5e517417a7300d3067f1/Vulnerability_(1800)_Sergey_Tarasov_Alamy.png" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 19:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Unpatched, PhantomRPC, Flaw, Windows, Enables, Privilege, Escalation</media:keywords>
</item>

<item>
<title>Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 Attack</title>
<link>https://block385.com/checkmarx-confirms-github-repository-data-posted-on-dark-web-after-march-23-attack</link>
<guid>https://block385.com/checkmarx-confirms-github-repository-data-posted-on-dark-web-after-march-23-attack</guid>
<description><![CDATA[ Checkmarx has disclosed that its ongoing investigation tied to the supply chain security incident has revealed that a cybercriminal group published data related to the company on the dark web.
&quot;Based on current evidence, we believe this data originated from Checkmarx&#039;s GitHub repository, and that access to that repository was facilitated through the initial supply chain attack of March 23, 2026, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWLDpoCXOE_C970Jb9YXSPl2DIDXlL2K2ZDch28huIDzQhLoliuasxjBz3mmCWcDe2u136HN7pDJUu0XBjVkgP6lQJSQTRL4VU_jqhXNwQyb8xLdDD8-9WKQxGp7eT_7WzNpqYPplV1nvvSF5cPwsT3q88d-52g7iU_hP9pxCoU5muOhBTqnTHgGl8Scr8/s1600/Checkmarx.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 18:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Checkmarx, Confirms, GitHub, Repository, Data, Posted, Dark, Web, After, March, Attack</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking &amp;amp; More</title>
<link>https://block385.com/weekly-recap-fast16-malware-xchat-launch-federal-backdoor-ai-employee-tracking-more</link>
<guid>https://block385.com/weekly-recap-fast16-malware-xchat-launch-federal-backdoor-ai-employee-tracking-more</guid>
<description><![CDATA[ Everything is dumb again. This week feels broken in a very familiar way. Old tricks are back. New tools are doing shady crap. Supply chains got hit. Fake help desks worked. Weird research showed how easy some attacks still are.
Most of it feels like stuff we should have fixed years ago. Bad extensions. Stolen creds. Remote tools are getting abused. Malware hides in places people trust. Same ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1eEqmWavzJwy68cdm3DB_l6dZO3ja-RjrtStTMh8_AA5AwWVDhwqEHJIYOPo98lAQ1yDrMZL1Yl2LxeSbk25vsQQI7csJuilXZRo-frfCj9ULE507sQBgvEBM0Y_RkYAWtUteoShXMRAD70JhGRjah1cBzZCew3meQp5xP5-Jv72-ZI4veiUa-aJnMYAK/s1600/cybrecap.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 18:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>⚡, Weekly, Recap:, Fast16, Malware, XChat, Launch, Federal, Backdoor, Employee, Tracking, More</media:keywords>
</item>

<item>
<title>20&#45;Year&#45;Old Malware Rewrites History of Cyber Sabotage</title>
<link>https://block385.com/20-year-old-malware-rewrites-history-of-cyber-sabotage</link>
<guid>https://block385.com/20-year-old-malware-rewrites-history-of-cyber-sabotage</guid>
<description><![CDATA[ Researchers have uncovered a malware framework dubbed &quot;fast16&quot;  that predates Stuxnet by 5 years. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt420e8d1d004052f7/69ebe377149efc36ed6727fc/math_vectorfusionart_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 17:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>20-Year-Old, Malware, Rewrites, History, Cyber, Sabotage</media:keywords>
</item>

<item>
<title>Parsing Agentic Offensive Security&amp;apos;s Existential Threat</title>
<link>https://block385.com/parsing-agentic-offensive-securitys-existential-threat</link>
<guid>https://block385.com/parsing-agentic-offensive-securitys-existential-threat</guid>
<description><![CDATA[ Some fear frontier LLMs like Claude Mythos and Anthropic&#039;s GPT-5.5 will lead to cybersecurity annihilation. Ari Herbert-Voss notes this could be an opportunity. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt2fef6368d5e830b7/69eb4af7883e502388cb2f46/mushroomcloud-_STOCKFOLIO-alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 17:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Parsing, Agentic, Offensive, Securitys, Existential, Threat</media:keywords>
</item>

<item>
<title>Helping Romance Scam Victims Requires a Proactive, Empathic Approach</title>
<link>https://block385.com/helping-romance-scam-victims-requires-a-proactive-empathic-approach</link>
<guid>https://block385.com/helping-romance-scam-victims-requires-a-proactive-empathic-approach</guid>
<description><![CDATA[ People targeted by confidence schemes find getting help is a lonely road. Experts want law enforcement, financial, and government institutions to work together and protect them. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt699701584743837c/64f17958cc9d3b15583a72fd/scam_keyboard_Chih-Chung_Johnny_Chang_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 15:00:01 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Helping, Romance, Scam, Victims, Requires, Proactive, Empathic, Approach</media:keywords>
</item>

<item>
<title>Mythos Changed the Math on Vulnerability Discovery. Most Teams Aren&amp;apos;t Ready for the Remediation Side</title>
<link>https://block385.com/mythos-changed-the-math-on-vulnerability-discovery-most-teams-arent-ready-for-the-remediation-side</link>
<guid>https://block385.com/mythos-changed-the-math-on-vulnerability-discovery-most-teams-arent-ready-for-the-remediation-side</guid>
<description><![CDATA[ Anthropic’s Claude Mythos Preview has dominated security discussions since its April 7 announcement. Early reporting describes a powerful cybersecurity-focused AI system capable of identifying vulnerabilities at scale and raising serious questions about how quickly organizations can validate, prioritize, and remediate what it finds.
The debate that followed has mostly focused on the right ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiR-gtpmKWvXoC5M5eOQM8k01yoiVjMDTYwRePtuLtpEPMevNdUs3BrVGykkop3OgF-DGCjpXB5T_AS84khCvVv7J-4W-7aE2ND0VuYbnyD8B6l1DUk_TVi96ab977o9i81hIIubY3l5F2A7_Qe4P4-qMTMzwnrvoXYC3cRhBU0X1VpG4F_MwstEGUQYHg/s1600/unnamed.png" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 14:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mythos, Changed, the, Math, Vulnerability, Discovery., Most, Teams, Arent, Ready, for, the, Remediation, Side</media:keywords>
</item>

<item>
<title>PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks</title>
<link>https://block385.com/phantomcore-exploits-trueconf-vulnerabilities-to-breach-russian-networks</link>
<guid>https://block385.com/phantomcore-exploits-trueconf-vulnerabilities-to-breach-russian-networks</guid>
<description><![CDATA[ A pro-Ukrainian hacktivist group called PhantomCore has been attributed to attacks actively targeting servers running TrueConf video conferencing software in Russia since September 2025.
That&#039;s according to a report published by Positive Technologies, which found the threat actors to be leveraging an exploit chain comprising three vulnerabilities to execute commands remotely on susceptible ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi02vvwkoYlj343usA-GYXcQHZKIceJufKYFzZNyHlsGQ6lCPD8H8bHEWtzBnJsWmnlQsGq0fBLgyKTdnOoEi83L3kQ8V3EOou_vlAmMhnMDFU5P5LxA-Sz1agVhDmFrd2qKHGnYZituJuoAEsHp0ExFR4pw6VCf9VNESl7C4q5Wkefh6_8rN2MDK96yh_a/s1600/russian-cyberattack.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 14:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>PhantomCore, Exploits, TrueConf, Vulnerabilities, Breach, Russian, Networks</media:keywords>
</item>

<item>
<title>Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware</title>
<link>https://block385.com/researchers-uncover-73-fake-vs-code-extensions-delivering-glassworm-v2-malware</link>
<guid>https://block385.com/researchers-uncover-73-fake-vs-code-extensions-delivering-glassworm-v2-malware</guid>
<description><![CDATA[ Cybersecurity researchers have flagged dozens of Microsoft Visual Studio Code (VS Code) extensions on the Open VSX repository that are linked to a persistent information-stealing campaign dubbed GlassWorm.
The cluster of 73 extensions has been identified as cloned versions of their legitimate counterparts. Of these, six have been confirmed to be malicious, with the remaining acting as seemingly ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhptNKAIMY9gm1kv8ULlpPvZh-F4HFaSveiiGCF8qbXkps5m4__rCDykkMAYSG4kg6r1pDv-EDRBTloxLF1yJC5hJJyfrq4J2anUCcgfYP9-nuYuPHh16pC7j0OzTqNvC2TQwbwFcna6nUQ_ZDkZt9NJRi3N3AZnt8qyVsmfans82j_uck31bzBMl4WWdRJ/s1600/vscode.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 14:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researchers, Uncover, Fake, Code, Extensions, Delivering, GlassWorm, Malware</media:keywords>
</item>

<item>
<title>Fake CAPTCHA IRSF Scam and 120 Keitaro Campaigns Drive Global SMS, Crypto Fraud</title>
<link>https://block385.com/fake-captcha-irsf-scam-and-120-keitaro-campaigns-drive-global-sms-crypto-fraud</link>
<guid>https://block385.com/fake-captcha-irsf-scam-and-120-keitaro-campaigns-drive-global-sms-crypto-fraud</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a telecommunications fraud campaign that uses fake CAPTCHA verification tricks to dupe unsuspecting users into sending international text messages that incur charges on their mobile bills, generating illicit revenue for the threat actors who lease the phone numbers.
According to a new report published by Infoblox, the operation is believed to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi-cI0h0qDxREUkTFlIqeT_9-QNxJHPv6SqDQXpMs00i8A26QWukWlxtk1iwdZvnar80HiymWGDY9148_CiWIdL2xj-t9xC9KDM-8WdGALuTRxhdZqDcaZf2MG9adEpZLkLqsaA2uMP-3e_E0Ru-A5JSv0_dvEjAAniYpsdS71SCxFVlmB1NhkL20oangQz/s1600/sim-card.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 12:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fake, CAPTCHA, IRSF, Scam, and, 120, Keitaro, Campaigns, Drive, Global, SMS, Crypto, Fraud</media:keywords>
</item>

<item>
<title>Your IAM was built for humans, AI agents don’t care</title>
<link>https://block385.com/your-iam-was-built-for-humans-ai-agents-dont-care</link>
<guid>https://block385.com/your-iam-was-built-for-humans-ai-agents-dont-care</guid>
<description><![CDATA[ Identity and access management was built for a simpler world. One where the hardest problem was a human logging in, and where “Who are you?” was sufficient to decide what someone could do. That model served enterprises well for decades. It was not built for a world where non-human identities now account for more than 90% of all authentications, where AI agents act across systems, trigger chains of API calls, and make access decisions in … More →
The post Your IAM was built for humans, AI agents don’t care appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/28162754/face-glitch-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 11:00:17 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Your, IAM, was, built, for, humans, agents, don’t, care</media:keywords>
</item>

<item>
<title>Aptori expands its platform with autonomous offensive testing to reduce security bottlenecks</title>
<link>https://block385.com/aptori-expands-its-platform-with-autonomous-offensive-testing-to-reduce-security-bottlenecks</link>
<guid>https://block385.com/aptori-expands-its-platform-with-autonomous-offensive-testing-to-reduce-security-bottlenecks</guid>
<description><![CDATA[ Aptori has expanded its Runtime-Driven Validation Platform with autonomous offensive testing capabilities to address the growing gap between code output and security team capacity. By moving beyond passive scanning to active validation, the platform helps organizations identify, validate, and fix vulnerabilities at the pace of development. As AI-assisted coding increases development velocity, traditional point-in-time security assessments have become a bottleneck. Most security tools produce large volumes of findings that require manual triage, slowing teams down … More →
The post Aptori expands its platform with autonomous offensive testing to reduce security bottlenecks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 11:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Aptori, expands, its, platform, with, autonomous, offensive, testing, reduce, security, bottlenecks</media:keywords>
</item>

<item>
<title>The AI criminal mastermind is already hiring on gig platforms</title>
<link>https://block385.com/the-ai-criminal-mastermind-is-already-hiring-on-gig-platforms</link>
<guid>https://block385.com/the-ai-criminal-mastermind-is-already-hiring-on-gig-platforms</guid>
<description><![CDATA[ Labor-hire platforms let anyone with a credit card post a task and pay a stranger to complete it. The RentAHuman platform extends that model to AI agents through a Model Context Protocol server, allowing an agent to post gigs directly. Listed tasks include attending in-person meetings, photographing locations, delivering items, and surveying physical sites. A paper by Joshua Krook, an Era AI Fellow at the University of Antwerp, works through the legal consequences of this … More →
The post The AI criminal mastermind is already hiring on gig platforms appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/24104332/ai-person-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 09:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, criminal, mastermind, already, hiring, gig, platforms</media:keywords>
</item>

<item>
<title>Product showcase: LuLu reveals unauthorized outbound connections from Mac apps</title>
<link>https://block385.com/product-showcase-lulu-reveals-unauthorized-outbound-connections-from-mac-apps</link>
<guid>https://block385.com/product-showcase-lulu-reveals-unauthorized-outbound-connections-from-mac-apps</guid>
<description><![CDATA[ LuLu is a free, open-source firewall for macOS that lets you control which apps are allowed to send data from your computer. macOS includes a built-in firewall, but it mainly handles incoming connections. LuLu also monitors outgoing traffic. Installing and setting Up LuLu After downloading and installing the app, I allowed the LuLu Network Extension in macOS Settings. I then followed the configuration process. When I launched the app for the first time, the Settings … More →
The post Product showcase: LuLu reveals unauthorized outbound connections from Mac apps appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/24114900/lulu-mac_firewall-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 07:00:20 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Product, showcase:, LuLu, reveals, unauthorized, outbound, connections, from, Mac, apps</media:keywords>
</item>

<item>
<title>25 open&#45;source cybersecurity tools that don’t care about your budget</title>
<link>https://block385.com/25-open-source-cybersecurity-tools-that-dont-care-about-your-budget</link>
<guid>https://block385.com/25-open-source-cybersecurity-tools-that-dont-care-about-your-budget</guid>
<description><![CDATA[ Regardless of the operating system you use, managing secrets, apps, cloud, compliance, and security operations can be overwhelming. The free, open-source tools presented in this article can help you detect threats, increase visibility, enforce controls, and investigate and respond to incidents throughout the development and operational lifecycle. Allama: Open-source AI security automation Allama is an open-source security automation platform that lets teams build visual workflows for threat detection and response. It includes integrations with 80+ … More →
The post 25 open-source cybersecurity tools that don’t care about your budget appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/06/16113416/open-source_security_tools-1500-2.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 07:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>open-source, cybersecurity, tools, that, don’t, care, about, your, budget</media:keywords>
</item>

<item>
<title>Helping Romance Scam Victims Require a Proactive, Empathic Approach</title>
<link>https://block385.com/helping-romance-scam-victims-require-a-proactive-empathic-approach</link>
<guid>https://block385.com/helping-romance-scam-victims-require-a-proactive-empathic-approach</guid>
<description><![CDATA[ People targeted by confidence schemes find getting help is a lonely road. Experts want law enforcement, financial and government institutions to work together and protect them. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt699701584743837c/64f17958cc9d3b15583a72fd/scam_keyboard_Chih-Chung_Johnny_Chang_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 27 Apr 2026 03:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Helping, Romance, Scam, Victims, Require, Proactive, Empathic, Approach</media:keywords>
</item>

<item>
<title>Week in review: Claude Mythos finds 271 Firefox flaws, Vercel breach</title>
<link>https://block385.com/week-in-review-claude-mythos-finds-271-firefox-flaws-vercel-breach</link>
<guid>https://block385.com/week-in-review-claude-mythos-finds-271-firefox-flaws-vercel-breach</guid>
<description><![CDATA[ Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: SmokedMeat: Open-source tool shows what attackers do inside CI/CD pipelines Boost Security has released SmokedMeat, an open-source framework that runs attack chains against CI/CD infrastructure so engineering and security teams can see what an attacker would do in their specific environment. NGate NFC malware targets Android users through trojanized payment app NFC-based payment fraud is expanding geographically and operationally. A … More →
The post Week in review: Claude Mythos finds 271 Firefox flaws, Vercel breach appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/12/01112502/cybersecurity_week_in_review1.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 26 Apr 2026 11:00:14 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Week, review:, Claude, Mythos, finds, 271, Firefox, flaws, Vercel, breach</media:keywords>
</item>

<item>
<title>Researchers Uncover Pre&#45;Stuxnet ‘fast16’ Malware Targeting Engineering Software</title>
<link>https://block385.com/researchers-uncover-pre-stuxnet-fast16-malware-targeting-engineering-software</link>
<guid>https://block385.com/researchers-uncover-pre-stuxnet-fast16-malware-targeting-engineering-software</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a new Lua-based malware created years before the notorious Stuxnet worm that aimed to sabotage Iran&#039;s nuclear program by destroying uranium enrichment centrifuges.
According to a new report published by SentinelOne, the previously undocumented cyber sabotage framework dates back to 2005, primarily targeting high-precision calculation software to tamper ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizs_g3Pi3X0KEIbHkq8WujTF9X1RE6Fu_p8CiWmZrjsBj0MK-OTgAj5Dn8hz_8-n_3KmkNhFYDHeKUxeAnJv3nWdqwu5XlKsUEC0yq-uOESR7HkzKLJ1-FdrJtyBy05M0NZ4HkrXZ_eCvCSEX3Y4jauh6A4loJ_gY-F5aOT39ZMn4noffniWz8VgIv1zA2/s1600/fast16-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 25 Apr 2026 12:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researchers, Uncover, Pre-Stuxnet, ‘fast16’, Malware, Targeting, Engineering, Software</media:keywords>
</item>

<item>
<title>CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal Deadline</title>
<link>https://block385.com/cisa-adds-4-exploited-flaws-to-kev-sets-may-2026-federal-deadline</link>
<guid>https://block385.com/cisa-adds-4-exploited-flaws-to-kev-sets-may-2026-federal-deadline</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added four vulnerabilities impacting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X series routers to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The list of vulnerabilities is below -

CVE-2024-57726 (CVSS score: 9.9) - A missing authorization vulnerability in ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgBMgO4j_Nf0B9HdU4WtN1axBdJFNJgV6Xvb8pCk0kooK6_-gNIxfURSqLIJuuzaufzvoXVTkFFg9WfMkyHvu4h_DBQK4QMJ21JYdwWtLem-CSOgTEYFhXazp4aSPJJglbiZel1V5aatqMKFCXk3scw-3UmMzQPrmTn-CbgBBjpLu_i4TBfNyS2kgZSkreW/s1600/cisa-kev.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 25 Apr 2026 08:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, Adds, Exploited, Flaws, KEV, Sets, May, 2026, Federal, Deadline</media:keywords>
</item>

<item>
<title>Indirect prompt injection is taking hold in the wild</title>
<link>https://block385.com/indirect-prompt-injection-is-taking-hold-in-the-wild</link>
<guid>https://block385.com/indirect-prompt-injection-is-taking-hold-in-the-wild</guid>
<description><![CDATA[ The open web is slowly but surely filling up with “traps” designed for LLM-powered AI agents. The technique, known as indirect prompt injection (IPI), involves hiding (more or less) covert instructions inside ordinary web pages, waiting for an AI agent to read them and carry out the author’s commands. The IPI attack kill chain (Source: Forcepoint) “Ignore previous instructions” In back-to-back reports published this week, Google and Forcepoint researchers laid out real-world evidence of these … More →
The post Indirect prompt injection is taking hold in the wild appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/08/28142151/agentic-ai-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 23:00:26 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Indirect, prompt, injection, taking, hold, the, wild</media:keywords>
</item>

<item>
<title>Users advised to drop passwords and make room for passkeys</title>
<link>https://block385.com/users-advised-to-drop-passwords-and-make-room-for-passkeys</link>
<guid>https://block385.com/users-advised-to-drop-passwords-and-make-room-for-passkeys</guid>
<description><![CDATA[ In a decisive move that could reshape how users log in online, the National Cyber Security Centre (NCSC) is urging consumers to abandon passwords in favour of passkeys, positioning them as the future of authentication. “Passkeys should become consumers’ first choice for logging into digital services,” NCSC said. Overhauling decades of security guidance, the agency will no longer recommend passwords where passkeys are available, citing their weaker resistance to current cyber threats. Since most breaches … More →
The post Users advised to drop passwords and make room for passkeys appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/25153052/passkeys-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 23:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Users, advised, drop, passwords, and, make, room, for, passkeys</media:keywords>
</item>

<item>
<title>US Busts Myanmar Ring Targeting US Citizens in Financial Fraud</title>
<link>https://block385.com/us-busts-myanmar-ring-targeting-us-citizens-in-financial-fraud</link>
<guid>https://block385.com/us-busts-myanmar-ring-targeting-us-citizens-in-financial-fraud</guid>
<description><![CDATA[ Some 29 people were charged, including a Cambodian senator, and authorities seized more than 500 Web domains tied to fake investment sites. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt798fb98cb0e72278/69eba133172e119ab194fef8/SE_Asia-slegers_hans-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Busts, Myanmar, Ring, Targeting, Citizens, Financial, Fraud</media:keywords>
</item>

<item>
<title>FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches</title>
<link>https://block385.com/firestarter-backdoor-hit-federal-cisco-firepower-device-survives-security-patches</link>
<guid>https://block385.com/firestarter-backdoor-hit-federal-cisco-firepower-device-survives-security-patches</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has revealed that an unnamed federal civilian agency&#039;s Cisco Firepower device running Adaptive Security Appliance (ASA) software was compromised in September 2025 with malware called FIRESTARTER.
FIRESTARTER, per CISA and the U.K.&#039;s National Cyber Security Centre (NCSC), is assessed to be a backdoor designed for remote access and ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhL39ca_K84pnKcPSv77aXouF3t3HCOjjL1zFVEdeDE64LiUxQ2Het8xQeTeO0JZRHZE56SbG87psVmhYCbSyu5PE3FZiHrAIzm0zp8nfGKk7XwVTUUjpeZ7zDEZwuJaQkZp6Cl20WF7qkWDAuaOQW5-OtTQ1ZvjW4xhHB9HrC2O-C6pPPnE94gLqp1GZrI/s1600/cisco.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 20:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>FIRESTARTER, Backdoor, Hit, Federal, Cisco, Firepower, Device, Survives, Security, Patches</media:keywords>
</item>

<item>
<title>Glasswing Secured the Code. The Rest of Your Stack Is Still on You</title>
<link>https://block385.com/glasswing-secured-the-code-the-rest-of-your-stack-is-still-on-you</link>
<guid>https://block385.com/glasswing-secured-the-code-the-rest-of-your-stack-is-still-on-you</guid>
<description><![CDATA[ Forgotten integrations, shadow IT, SaaS, and now shadow AI and agents are everywhere, and attackers don&#039;t need sophisticated AI models to take advantage. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6fceb678bad33d92/69eace49fd15051754836a22/Glasswing_Casimiro_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 19:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Glasswing, Secured, the, Code., The, Rest, Your, Stack, Still, You</media:keywords>
</item>

<item>
<title>NASA Employees Duped in Chinese Phishing Scheme Targeting U.S. Defense Software</title>
<link>https://block385.com/nasa-employees-duped-in-chinese-phishing-scheme-targeting-us-defense-software</link>
<guid>https://block385.com/nasa-employees-duped-in-chinese-phishing-scheme-targeting-us-defense-software</guid>
<description><![CDATA[ The Office of Inspector General (OIG) of the U.S. National Aeronautics and Space Administration (NASA) has revealed how a Chinese national posed as a U.S. researcher as part of a spear-phishing campaign to obtain sensitive information from the space agency, as well as from government entities, universities, and private companies, in violation of export control laws.
&quot;For years, NASA employees ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHAuHNFOxvs6UDl3EnaRiFcpN6xXjeqMCeudHBwRKzbIoUCdno0MHlfe2ijlnYU7D5k0vi4nlhv9j_hkR4zeaHTq2xewCOVza2_qYZZxpy_Qy1V_IQu5nO5lDyGzeG3P_B5kSbGT5W01Ic0E_FuSlWat1zsWYCDHhYbqQ_S5Q8p1WO14UStW8EJ4PIkKuX/s1600/WANTED.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 18:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NASA, Employees, Duped, Chinese, Phishing, Scheme, Targeting, U.S., Defense, Software</media:keywords>
</item>

<item>
<title>AI Phishing Is No. 1 With a Bullet for Cyberattackers</title>
<link>https://block385.com/ai-phishing-is-no-1-with-a-bullet-for-cyberattackers</link>
<guid>https://block385.com/ai-phishing-is-no-1-with-a-bullet-for-cyberattackers</guid>
<description><![CDATA[ In the past six months, companies have seen a significant influx of AI-powered phishing, as cyberattackers progress from small campaigns to 1-to-1 personalized attacks. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 17:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Phishing, No., With, Bullet, for, Cyberattackers</media:keywords>
</item>

<item>
<title>North Korea&amp;apos;s Lazarus Targets macOS Users via ClickFix</title>
<link>https://block385.com/north-koreas-lazarus-targets-macos-users-via-clickfix</link>
<guid>https://block385.com/north-koreas-lazarus-targets-macos-users-via-clickfix</guid>
<description><![CDATA[ Lazarus continues leveraging ClickFix for initial access and data theft, in this case, against Mac-centric organizations and their high-value leaders. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt955244a1688ad92a/69ea733c149efc64d46724f4/Mouse_click_Alexey_Stiop_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 15:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>North, Koreas, Lazarus, Targets, macOS, Users, via, ClickFix</media:keywords>
</item>

<item>
<title>Bridging the AI Agent Authority Gap: Continuous Observability as the Decision Engine</title>
<link>https://block385.com/bridging-the-ai-agent-authority-gap-continuous-observability-as-the-decision-engine</link>
<guid>https://block385.com/bridging-the-ai-agent-authority-gap-continuous-observability-as-the-decision-engine</guid>
<description><![CDATA[ The AI Agent Authority Gap - From Ungoverned to Delegation
As discussed in our previous article, AI agents are exposing a structural gap in enterprise security, but the problem is often framed too narrowly.
The issue is not simply that agents are new actors. It is that agents are delegated actors. They do not emerge with independent authority. They are triggered, invoked, provisioned, or ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZTTjYlof51AlGz6c8vyYmpqVPODX_zgUiWkJ-Mgq8a5d6pfOrUQqgu2A7H3dIcv7k4_AYSTxitHZiCxve_l8QG-zLLqgkLLdudvwjASI7p3CUtk6O0rntkr_mDPcUK66NPMoGEVWvS1mMKFzNKpRTAN2Wv9jLdLwcOlNAtlqfLCSCKpqHldT1e9AnnD0/s1600/or.gif" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bridging, the, Agent, Authority, Gap:, Continuous, Observability, the, Decision, Engine</media:keywords>
</item>

<item>
<title>26 FakeWallet Apps Found on Apple App Store Targeting Crypto Seed Phrases</title>
<link>https://block385.com/26-fakewallet-apps-found-on-apple-app-store-targeting-crypto-seed-phrases</link>
<guid>https://block385.com/26-fakewallet-apps-found-on-apple-app-store-targeting-crypto-seed-phrases</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a set of malicious apps on the Apple App Store that impersonate popular cryptocurrency wallets in an attempt to steal recovery phrases and private keys since at least fall 2025.
&quot;Once launched, these apps redirect users to browser pages designed to look similar to the App Store and distribute trojanized versions of legitimate wallets,&quot; Kaspersky ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFcKlAJD87JqpQgBraCHiotcX52rMft8iVqUuhlFlU-NTgMxjYfB2UQ0WLUbQ7yR_qCy9kvXJDFbZEHe10gEEOSUcKcUY6arDzLhyurrKlngubO7Lulc_nSHthxHv7WXqma34SDUl4o_F9Zw9N-1GQnTsxo3v-jO8eWTvRCx8hHmf5EaLCZMknYfMGpfcP/s1600/iphone.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>FakeWallet, Apps, Found, Apple, App, Store, Targeting, Crypto, Seed, Phrases</media:keywords>
</item>

<item>
<title>With AI’s help, North Korean hackers stumbled into a near&#45;undetectable attack</title>
<link>https://block385.com/with-ais-help-north-korean-hackers-stumbled-into-a-near-undetectable-attack</link>
<guid>https://block385.com/with-ais-help-north-korean-hackers-stumbled-into-a-near-undetectable-attack</guid>
<description><![CDATA[ For many years, state-sponsored hacking was defined by human expertise in finding security holes, writing malware and exploits, pulling off social engineering and phishing attacks, and much more. Since the advent of LLM-powered AI assistants and tools, less skilled attackers have been able to carry out attacks and compromises that might otherwise have been out of their reach. Case in point: HexagonalRodent. According to Expel’s research, the group makes heavy use of generative AI, with … More →
The post With AI’s help, North Korean hackers stumbled into a near-undetectable attack appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/23110249/north_korea-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:59 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>With, AI’s, help, North, Korean, hackers, stumbled, into, near-undetectable, attack</media:keywords>
</item>

<item>
<title>Where AI in CI/CD is working for engineering teams</title>
<link>https://block385.com/where-ai-in-cicd-is-working-for-engineering-teams</link>
<guid>https://block385.com/where-ai-in-cicd-is-working-for-engineering-teams</guid>
<description><![CDATA[ Developers have folded AI into daily coding work. Still, the same tools remain largely absent from the systems that validate and ship software. New research from JetBrains points to a widening gap between how engineers write code on their own machines and what runs inside continuous integration and delivery pipelines. Daily coding use climbs past 90% Workplace use of AI among developers exceeds 90%. The figure comes from three JetBrains studies: the AI Pulse survey … More →
The post Where AI in CI/CD is working for engineering teams appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/23154258/devel.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:58 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Where, CICD, working, for, engineering, teams</media:keywords>
</item>

<item>
<title>IT spending to hit $6.31 trillion record, thanks to AI</title>
<link>https://block385.com/it-spending-to-hit-631-trillion-record-thanks-to-ai</link>
<guid>https://block385.com/it-spending-to-hit-631-trillion-record-thanks-to-ai</guid>
<description><![CDATA[ Global spending on IT is expected to reach $6.31 trillion in 2026, according to the latest quarterly forecast from Gartner, marking a 13.5% increase from the previous year. The forecast shows that growth is spread across all major segments, though not evenly. Much of the increase is tied to ongoing investment in AI, particularly in the infrastructure needed to support it, such as servers, data centers, and specialized hardware. “This latest forecast underscores the accelerating … More →
The post IT spending to hit $6.31 trillion record, thanks to AI appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/23143436/money_hardware.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:57 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>spending, hit, 6.31, trillion, record, thanks</media:keywords>
</item>

<item>
<title>A study of 1,000 Android apps finds a privacy policy logging gap</title>
<link>https://block385.com/a-study-of-1000-android-apps-finds-a-privacy-policy-logging-gap</link>
<guid>https://block385.com/a-study-of-1000-android-apps-finds-a-privacy-policy-logging-gap</guid>
<description><![CDATA[ Android developers write log statements for the same reasons they always have: debugging crashes, tracing performance issues, and understanding how features behave in production. Legal and privacy teams, working from templates and regulatory checklists, draft policies describing what the app collects from users. These two workflows rarely intersect inside the same company. A new study of 1,000 Android apps shows what that disconnect looks like at scale, and the gap has implications for GDPR and … More →
The post A study of 1,000 Android apps finds a privacy policy logging gap appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/23101514/android-broken-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:55 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>study, 1, 000, Android, apps, finds, privacy, policy, logging, gap</media:keywords>
</item>

<item>
<title>AI is speeding up nation&#45;state cyber programs</title>
<link>https://block385.com/ai-is-speeding-up-nation-state-cyber-programs</link>
<guid>https://block385.com/ai-is-speeding-up-nation-state-cyber-programs</guid>
<description><![CDATA[ In this Help Net Security interview, Kaja Ciglic, Senior Director, Cybersecurity Policy and Diplomacy at Microsoft, discusses how nation-state cyber programs have changed over three years. Cyber has become a core instrument of state power, integrated with military, economic, and diplomatic tools. Ciglic argues that responses like sanctions and indictments need broader strategies, including conditional economic pressure and state accountability for ransomware havens. She addresses NATO’s Article 5 ambiguity around cyber attacks and calls for … More →
The post AI is speeding up nation-state cyber programs appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/23151100/kaja_ciglic-2-microsoft.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:52 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>speeding, nation-state, cyber, programs</media:keywords>
</item>

<item>
<title>OpenAI’s GPT&#45;5.5 is out with expanded cybersecurity safeguards</title>
<link>https://block385.com/openais-gpt-55-is-out-with-expanded-cybersecurity-safeguards</link>
<guid>https://block385.com/openais-gpt-55-is-out-with-expanded-cybersecurity-safeguards</guid>
<description><![CDATA[ Competition to release stronger AI models is accelerating, and just weeks after the release of GPT-5.4, OpenAI has introduced GPT-5.5, pointing to expanded safeguards in the new model. GPT-5.5 is being rolled out to Plus, Pro, Business, and Enterprise users in ChatGPT and Codex, while GPT-5.5 Pro is available to Pro, Business, and Enterprise users in ChatGPT. The models are expected to be made available through the API soon. The company said it is working … More →
The post OpenAI’s GPT-5.5 is out with expanded cybersecurity safeguards appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/23221051/gpt-55-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:50 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI’s, GPT-5.5, out, with, expanded, cybersecurity, safeguards</media:keywords>
</item>

<item>
<title>Ubuntu 26.04 LTS delivers memory&#45;safe system tools and live patching for Arm servers</title>
<link>https://block385.com/ubuntu-2604-lts-delivers-memory-safe-system-tools-and-live-patching-for-arm-servers</link>
<guid>https://block385.com/ubuntu-2604-lts-delivers-memory-safe-system-tools-and-live-patching-for-arm-servers</guid>
<description><![CDATA[ Linux distributions have spent the past few years absorbing GPU vendor toolchains, Rust-based system components, and more stringent encryption defaults. Ubuntu 26.04 LTS, codenamed Resolute Raccoon, pulls most of those threads together into a single release that will receive standard security support until April 2031. Rust moves into the system layer One of the more consequential changes in this release is the expansion of memory-safe components at the OS level. Ubuntu 26.04 LTS ships with … More →
The post Ubuntu 26.04 LTS delivers memory-safe system tools and live patching for Arm servers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/24064115/ubuntu_26_04_lts_resolute_raccoon-l.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:46 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ubuntu, 26.04, LTS, delivers, memory-safe, system, tools, and, live, patching, for, Arm, servers</media:keywords>
</item>

<item>
<title>Meta is overhauling how you sign in, manage settings, and protect your accounts</title>
<link>https://block385.com/meta-is-overhauling-how-you-sign-in-manage-settings-and-protect-your-accounts</link>
<guid>https://block385.com/meta-is-overhauling-how-you-sign-in-manage-settings-and-protect-your-accounts</guid>
<description><![CDATA[ Meta Account gives users of Meta apps and devices a simpler way to access and manage their accounts. Accounts Center will automatically be updated to a Meta Account as part of a gradual rollout over the next year. Users will be notified when the change occurs. It supports Meta technologies including Facebook, Instagram, Messenger, Threads, Meta AI, AI glasses, and Meta Quest headsets. WhatsApp can be added optionally. It is only included if it was … More →
The post Meta is overhauling how you sign in, manage settings, and protect your accounts appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/24111457/meta-place.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:38 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Meta, overhauling, how, you, sign, in, manage, settings, and, protect, your, accounts</media:keywords>
</item>

<item>
<title>New Cisco firewall malware can only be killed by pulling the plug</title>
<link>https://block385.com/new-cisco-firewall-malware-can-only-be-killed-by-pulling-the-plug</link>
<guid>https://block385.com/new-cisco-firewall-malware-can-only-be-killed-by-pulling-the-plug</guid>
<description><![CDATA[ Suspected state-sponsored attackers are using a custom backdoor to persistently compromise Cisco security devices (firewalls), the US CISA and the UK National Cyber Security Centre warned on Thusday. “The [Firestarter] malware (…) is relevant for both Cisco Firepower and Secure Firewall devices; however, CISA has only observed a successful implant of the malware in the wild on a Cisco Firepower device running ASA software,” the Cybersecurity and Infrastructure Security Agency noted. CISA also shared threat … More →
The post New Cisco firewall malware can only be killed by pulling the plug appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/04/02170806/backdoor-1-1600.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:27 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Cisco, firewall, malware, can, only, killed, pulling, the, plug</media:keywords>
</item>

<item>
<title>Compromised everyday devices power Chinese cyber espionage operations</title>
<link>https://block385.com/compromised-everyday-devices-power-chinese-cyber-espionage-operations</link>
<guid>https://block385.com/compromised-everyday-devices-power-chinese-cyber-espionage-operations</guid>
<description><![CDATA[ China-linked threat actors have shifted from individually procured infrastructure to large-scale covert networks, botnets built from compromised routers and other edge devices, the National Cyber Security Centre (NCSC) warns. To help organizations address this threat, the NCSC, together with the Cyber League and partner agencies, has issued an advisory. The advisory includes guidance for organizations of all sizes, urging them to map and baseline traffic from edge devices, particularly VPN and remote access connections, and … More →
The post Compromised everyday devices power Chinese cyber espionage operations appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/03/26092845/hand-monitor-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Compromised, everyday, devices, power, Chinese, cyber, espionage, operations</media:keywords>
</item>

<item>
<title>Tropic Trooper Uses Trojanized SumatraPDF and GitHub to Deploy AdaptixC2</title>
<link>https://block385.com/tropic-trooper-uses-trojanized-sumatrapdf-and-github-to-deploy-adaptixc2</link>
<guid>https://block385.com/tropic-trooper-uses-trojanized-sumatrapdf-and-github-to-deploy-adaptixc2</guid>
<description><![CDATA[ Chinese-speaking individuals are the target of a new campaign that uses a trojanized version of SumatraPDF reader to deploy the AdaptixC2 Beacon post-exploitation agent and ultimately facilitate the abuse of Microsoft Visual Studio Code (VS Code) tunnels for remote access.
Zscaler ThreatLabz, which discovered the campaign last month, has attributed it with high confidence to Tropic Trooper (aka ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEheXZWhV-F6JpyIS7BshxCI158lslIFwx6XU9K15AoGDti8DVknLSrhAEc9HybQjSHfjfuKpGJ5by4EJamG4RV_7v8_SzlmhmSlxcfIBRaYX913E8f6-z0NQyMJ9g0VkszTUY726Csg6xWhwY16ygTe_JySvgj-JkaMyX4ZdM7yCuxRT_98lv22nywvy6r5/s1600/cyberattack.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 12:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tropic, Trooper, Uses, Trojanized, SumatraPDF, and, GitHub, Deploy, AdaptixC2</media:keywords>
</item>

<item>
<title>UNC6692 Impersonates IT Help Desk via Microsoft Teams to Deploy SNOW Malware</title>
<link>https://block385.com/unc6692-impersonates-it-help-desk-via-microsoft-teams-to-deploy-snow-malware</link>
<guid>https://block385.com/unc6692-impersonates-it-help-desk-via-microsoft-teams-to-deploy-snow-malware</guid>
<description><![CDATA[ A previously undocumented threat activity cluster known as UNC6692 has been observed leveraging social engineering tactics via Microsoft Teams to deploy a custom malware suite on compromised hosts.
&quot;As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT help desk employees, convincing their victim to accept a Microsoft Teams chat invitation from an account ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHoBLtF5qmS63UuZJdrs4DtwoJRc6V3OK_4vUjCp-mHUs99AlJkzxcQgZH-tD0dFneYJHfBEumdGw42jcqcYHYiqmNHBtHZVB7m83pxPakcbupcdcRmDzg2fedK4doHPUwOfGoqY2a44VUwgK1g8cyZSgpMmpzcbWuBrzxvdalA9bkt8_26WkdIfZy6qqa/s1600/helpdesk.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 12:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>UNC6692, Impersonates, Help, Desk, via, Microsoft, Teams, Deploy, SNOW, Malware</media:keywords>
</item>

<item>
<title>LMDeploy CVE&#45;2026&#45;33626 Flaw Exploited Within 13 Hours of Disclosure</title>
<link>https://block385.com/lmdeploy-cve-2026-33626-flaw-exploited-within-13-hours-of-disclosure</link>
<guid>https://block385.com/lmdeploy-cve-2026-33626-flaw-exploited-within-13-hours-of-disclosure</guid>
<description><![CDATA[ A high-severity security flaw in LMDeploy, an open-source toolkit for compressing, deploying, and serving LLMs, has come under active exploitation in the wild less than 13 hours after its public disclosure.
The vulnerability, tracked as CVE-2026-33626 (CVSS score: 7.5), relates to a Server-Side Request Forgery (SSRF) vulnerability that could be exploited to access sensitive data.
&quot;A server-side ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjQrFbHBSUJCgc3WB8IsBaYhvbOnk7jwkU3MRHO7YVAFZBBwi7LE2OZzC_oddjsfbh_YwW7czfQ0FzCpHyztt-N8po5TkqZqsOhm_LpW4dxmzaDtGkud-vho2R409maf5r_QBAPjGUpfFShbENQ-qIpwaQ0eNmBgD7U-Pgu4uFgSzGRxt6O7kKLAg_PyVg/s1600/lmdeploy.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 10:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>LMDeploy, CVE-2026-33626, Flaw, Exploited, Within, Hours, Disclosure</media:keywords>
</item>

<item>
<title>Tropic Trooper APT Takes Aim at Home Routers, Japanese Targets</title>
<link>https://block385.com/tropic-trooper-apt-takes-aim-at-home-routers-japanese-targets</link>
<guid>https://block385.com/tropic-trooper-apt-takes-aim-at-home-routers-japanese-targets</guid>
<description><![CDATA[ The Chinese state-sponsored cyber threat is known for moving fast and trying odd attack vectors; now it&#039;s branching out in tools, victimology, and TTPs. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf6b44cf37bbcf09b/69ea75dbb14e60a8c0fb9e7b/tropical1800_Marc_Anderson_alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 05:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tropic, Trooper, APT, Takes, Aim, Home, Routers, Japanese, Targets</media:keywords>
</item>

<item>
<title>China&#45;Backed Hackers Are Industrializing Botnets</title>
<link>https://block385.com/china-backed-hackers-are-industrializing-botnets</link>
<guid>https://block385.com/china-backed-hackers-are-industrializing-botnets</guid>
<description><![CDATA[ China&#039;s state-backed groups are now using covert networks of compromised devices to execute attacks in a low-cost, low-risk, and deniable way. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt015e58f9d5bdd548/69ea8696be3c0328a992e3db/china_GagoDesign_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 01:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>China-Backed, Hackers, Are, Industrializing, Botnets</media:keywords>
</item>

<item>
<title>UNC6692 Impersonates IT Helpdesk via Microsoft Teams to Deploy SNOW Malware</title>
<link>https://block385.com/unc6692-impersonates-it-helpdesk-via-microsoft-teams-to-deploy-snow-malware</link>
<guid>https://block385.com/unc6692-impersonates-it-helpdesk-via-microsoft-teams-to-deploy-snow-malware</guid>
<description><![CDATA[ A previously undocumented threat activity cluster known as UNC6692 has been observed leveraging social engineering tactics via Microsoft Teams to deploy a custom malware suite on compromised hosts.
&quot;As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT helpdesk employees, convincing their victim to accept a Microsoft Teams chat invitation from an account ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHoBLtF5qmS63UuZJdrs4DtwoJRc6V3OK_4vUjCp-mHUs99AlJkzxcQgZH-tD0dFneYJHfBEumdGw42jcqcYHYiqmNHBtHZVB7m83pxPakcbupcdcRmDzg2fedK4doHPUwOfGoqY2a44VUwgK1g8cyZSgpMmpzcbWuBrzxvdalA9bkt8_26WkdIfZy6qqa/s1600/helpdesk.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 20:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>UNC6692, Impersonates, Helpdesk, via, Microsoft, Teams, Deploy, SNOW, Malware</media:keywords>
</item>

<item>
<title>Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign</title>
<link>https://block385.com/bitwarden-cli-compromised-in-ongoing-checkmarx-supply-chain-campaign</link>
<guid>https://block385.com/bitwarden-cli-compromised-in-ongoing-checkmarx-supply-chain-campaign</guid>
<description><![CDATA[ Bitwarden CLI has been compromised as part of the newly discovered and ongoing Checkmarx supply chain campaign, according to new findings from JFrog and Socket.
&quot;The affected package version appears to be @bitwarden/cli@2026.4.0, and the malicious code was published in &#039;bw1.js,&#039; a file included in the package contents,&quot; the application security company said.
&quot;The attack appears to have leveraged ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3GuK50sJwMRH4ad8bcUVRSBm1Wk0X5Gj1dSalza49wWxFY9g3_E32271zOeqx6vsqrWY2SWAVnnXTKiJZvKbhxynk018zLTIlZpBNhFA_QVi6kzn7vATBe419m222ZMUcTToaSn19L4DgElrI9luwUv2EJk0efy5TLDIqIUyGcOnTvVU2KKZw9AMsMipz/s1600/bitwarden.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 18:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bitwarden, CLI, Compromised, Ongoing, Checkmarx, Supply, Chain, Campaign</media:keywords>
</item>

<item>
<title>ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories</title>
<link>https://block385.com/threatsday-bulletin-290m-defi-hack-macos-lotl-abuse-proxysmart-sim-farms-25-new-stories</link>
<guid>https://block385.com/threatsday-bulletin-290m-defi-hack-macos-lotl-abuse-proxysmart-sim-farms-25-new-stories</guid>
<description><![CDATA[ You scroll past one incident and see another that feels familiar, like it should have been fixed years ago, but it still works with small changes. Same bugs. Same mistakes.
The supply chain is messy. Packages you did not check are stealing data, adding backdoors, and spreading. Attacking the systems behind apps is easier than breaking the apps themselves. The exploits are simple but still work ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCPlFIV8w3UXOQRe4cwOn8C-x6WYxvZnNAOHSUnzIg8TFswCnJNoyTFJTdzAbl_a6JNCzhbAk4yGQbhI_cjF-FATAAmJJJiLjo2cZgbMQpfhYnrH6MFv6TVEqC3sblGQPViYTDE0o3alqO3YsIzatrw7NwlTkv1g6NkiVegSWKuRuQcajEyNdAUEaTamQ-/s1600/threatsday.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 18:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ThreatsDay, Bulletin:, 290M, DeFi, Hack, macOS, LotL, Abuse, ProxySmart, SIM, Farms, 25, New, Stories</media:keywords>
</item>

<item>
<title>Chinese APT Abuses Multiple Cloud Tools to Spy on Mongolia</title>
<link>https://block385.com/chinese-apt-abuses-multiple-cloud-tools-to-spy-on-mongolia</link>
<guid>https://block385.com/chinese-apt-abuses-multiple-cloud-tools-to-spy-on-mongolia</guid>
<description><![CDATA[ The threat actor gave itself plenty of options to support command and control, tapping Microsoft Outlook, Slack, Discord, and file.io for online espionage. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt17fc2cec7ba9f5b3/69e90f257417a71b03305c14/Beijing_Ulaanbaatar-Trevor_Mogg-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Chinese, APT, Abuses, Multiple, Cloud, Tools, Spy, Mongolia</media:keywords>
</item>

<item>
<title>Bad Memories Still Haunt AI Agents</title>
<link>https://block385.com/bad-memories-still-haunt-ai-agents</link>
<guid>https://block385.com/bad-memories-still-haunt-ai-agents</guid>
<description><![CDATA[ Cisco found and fixed a significant vulnerability in the way Anthropic handles memories, but experts warn that mishandled memory files will continue threaten AI systems. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0abdbe2d875193af/69de52650bc850de57243ab8/digital-brain-Billion_Photos-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bad, Memories, Still, Haunt, Agents</media:keywords>
</item>

<item>
<title>Africa Relinquishes Cyberattack Lead to Latin America — For Now</title>
<link>https://block385.com/africa-relinquishes-cyberattack-lead-to-latin-america-for-now</link>
<guid>https://block385.com/africa-relinquishes-cyberattack-lead-to-latin-america-for-now</guid>
<description><![CDATA[ The volume of cyberattacks targeting Africa declined in the past year, with weekly attacks down 22%, as attackers seemingly shifted their focus to other regions. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt041f5fc64dbe4d6f/679016b514bc5279608b2db9/Ground_Picture-Africa-cyber-identity-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Africa, Relinquishes, Cyberattack, Lead, Latin, America, —, For, Now</media:keywords>
</item>

<item>
<title>Electricity Is a Growing Area of Cyber Risk</title>
<link>https://block385.com/electricity-is-a-growing-area-of-cyber-risk</link>
<guid>https://block385.com/electricity-is-a-growing-area-of-cyber-risk</guid>
<description><![CDATA[ IT has long been concerned about ensuring systems receive the right amount of electricity. Cyberattackers are realizing they can manipulate voltage fluctuations for their purposes, too. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltdda8d92d977d3fd5/69e8dc16a28c2093e5e0035e/FH7C4H.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 15:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Electricity, Growing, Area, Cyber, Risk</media:keywords>
</item>

<item>
<title>[Webinar] Mythos Reality Check: Beating Automated Exploitation at AI Speed</title>
<link>https://block385.com/webinar-mythos-reality-check-beating-automated-exploitation-at-ai-speed</link>
<guid>https://block385.com/webinar-mythos-reality-check-beating-automated-exploitation-at-ai-speed</guid>
<description><![CDATA[ Imagine a world where hackers don&#039;t sleep, don&#039;t take breaks, and find weak spots in your systems instantly.
Well, that world is already here.
Thanks to AI, attackers are now launching automated, large-scale exploits faster than ever before. The time you have to fix a vulnerability before it gets attacked is shrinking to zero. We call this the Collapsing Exploit Window, and it means your ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirgCFjBm7wVU1Nve1GwsT-mX4Fm9C2OB25FN0xsgQxB5H1y0XN-I4TrfFH3f47uWBie1-yNBz_K2tuml0FOagCnaxI5xQvqoVbpzOUU6bCoaBZLohQWPSWF4r2YSEXIQKt3FRdoSXjvAk8OTmysTV4uoPD87y-3Boh7UzcJoUFIQxkmB576KIDMtU0YHDx/s1600/miggo-webinar.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Webinar, Mythos, Reality, Check:, Beating, Automated, Exploitation, Speed</media:keywords>
</item>

<item>
<title>Project Glasswing Proved AI Can Find the Bugs. Who&amp;apos;s Going to Fix Them?</title>
<link>https://block385.com/project-glasswing-proved-ai-can-find-the-bugs-whos-going-to-fix-them</link>
<guid>https://block385.com/project-glasswing-proved-ai-can-find-the-bugs-whos-going-to-fix-them</guid>
<description><![CDATA[ Last week, Anthropic announced Project Glasswing, an AI model so effective at discovering software vulnerabilities that they took the extraordinary step of postponing its public release. Instead, the company has given access to Apple, Microsoft, Google, Amazon, and a coalition of others to find and patch bugs before adversaries can.
Mythos Preview, the model that led to Project Glasswing, found ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkzSPo6TkrJjcTvsuM1O71fiiZ7gnKw4PqqtKu_TeAaZNr5qAEfsfVvoZv64F7EFULRIv8SKePHZehY_0g9AqyqlnMdTPF-OLf1S9RwmB-edOgYKEg1Llw-6m87CQBglHxbK3oS0Brnwc9_x_oi56XGuxe1V9vN0KfoY9cUmU4mplEHeqQxO-5byx79YY/s1600/picus-main.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Project, Glasswing, Proved, Can, Find, the, Bugs., Whos, Going, Fix, Them</media:keywords>
</item>

<item>
<title>Apple Fixes iOS Flaw That Let FBI Recover Deleted Signal Messages</title>
<link>https://block385.com/apple-fixes-ios-flaw-that-let-fbi-recover-deleted-signal-messages</link>
<guid>https://block385.com/apple-fixes-ios-flaw-that-let-fbi-recover-deleted-signal-messages</guid>
<description><![CDATA[ Apple has rolled out a software fix for iOS and iPadOS to address a Notification Services flaw that stored notifications marked for deletion on the device.
The vulnerability, tracked as CVE-2026-28950 (CVSS score: N/A), has been described as a logging issue that has been addressed with improved data redaction.
&quot;Notifications marked for deletion could be unexpectedly retained on the device,&quot; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8iikjICH9h-OY06K3jZBcEcwtWEuusLcRgwG1T5SvE39V2ZfqSe7Z7N3NFXzfxgYicI_yo8bvme9f4RYazoU-5dUmoTKJMgdmW38AuWgFEWKNBTxgqQJAgpwZUOS926Ue1qCGUW7ou2wStgU-vRsle4Ky8pcp2I2mT_Sm3eyUw__JZaO-BrBZ80z3Zhvx/s1600/apple-signal.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, Fixes, iOS, Flaw, That, Let, FBI, Recover, Deleted, Signal, Messages</media:keywords>
</item>

<item>
<title>GopherWhisper APT group hides command and control traffic in Slack and Discord</title>
<link>https://block385.com/gopherwhisper-apt-group-hides-command-and-control-traffic-in-slack-and-discord</link>
<guid>https://block385.com/gopherwhisper-apt-group-hides-command-and-control-traffic-in-slack-and-discord</guid>
<description><![CDATA[ Attackers continue to lean on everyday collaboration platforms to hide command and control traffic inside normal enterprise noise. A newly identified China-aligned APT group pushes that trend further, running its operations through Slack workspaces, Discord servers, Outlook drafts, and the file.io sharing service. GopherWhisper toolset overview ESET researchers have named the group GopherWhisper and tied it to an intrusion at a Mongolian governmental entity. The name draws on two elements: most of the group’s tooling … More →
The post GopherWhisper APT group hides command and control traffic in Slack and Discord appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/09194120/laptop-danger-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 13:00:14 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GopherWhisper, APT, group, hides, command, and, control, traffic, Slack, and, Discord</media:keywords>
</item>

<item>
<title>&amp;apos;Zealot&amp;apos; Shows What AI&amp;apos;s Capable of in Staged Cloud Attack</title>
<link>https://block385.com/zealot-shows-what-ais-capable-of-in-staged-cloud-attack</link>
<guid>https://block385.com/zealot-shows-what-ais-capable-of-in-staged-cloud-attack</guid>
<description><![CDATA[ The proof of concept revealed AI-based attacks unfold too fast for human defenders to respond, and that AI evinced more autonomous behavior than expected. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc3681a58fc1b6aef/69e936be6b27ed085e8c5508/aicyber_DigitalPen_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 13:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Zealot, Shows, What, AIs, Capable, Staged, Cloud, Attack</media:keywords>
</item>

<item>
<title>China&#45;Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors</title>
<link>https://block385.com/china-linked-gopherwhisper-infects-12-mongolian-government-systems-with-go-backdoors</link>
<guid>https://block385.com/china-linked-gopherwhisper-infects-12-mongolian-government-systems-with-go-backdoors</guid>
<description><![CDATA[ Mongolian governmental institutions have emerged as the target of a previously undocumented China-aligned advanced persistent threat (APT) group tracked as GopherWhisper.
&quot;The group wields a wide array of tools mostly written in Go, using injectors and loaders to deploy and execute various backdoors in its arsenal,&quot; Slovakian cybersecurity company ESET said in a report shared with The Hacker ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcPZEHQ2ePgeeD1JO3nqkHDxu5XWd53XZ8GsPxgX5Gl3vY-isf7bdT1_8ZGbMGOwic5gJKYXp0G5rIiSacQvidnb3_voREgqsyanhwo0uQs1HLNXACrsV2tLmHXlxA4FizErdbwb5o35MEDIrZKMkDsAAzIVPt0g6pTMbsZSN7SIwTEozmgX7MO26XxapY/s1600/chinese-hacking.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 12:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>China-Linked, GopherWhisper, Infects, Mongolian, Government, Systems, with, Backdoors</media:keywords>
</item>

<item>
<title>Vercel Finds More Compromised Accounts in Context.ai&#45;Linked Breach</title>
<link>https://block385.com/vercel-finds-more-compromised-accounts-in-contextai-linked-breach</link>
<guid>https://block385.com/vercel-finds-more-compromised-accounts-in-contextai-linked-breach</guid>
<description><![CDATA[ Vercel on Wednesday revealed that it has identified an additional set of customer accounts that were compromised as part of a security incident that enabled unauthorized access to its internal systems.
The company said it made the discovery after expanding its investigation to include an extra set of compromise indicators, alongside a review of requests to the Vercel network and environment ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzwM3USZlfhbZvEZWWJp8Qa4g-UzetuH1vkGUsyr3Ju00B8gC8z791k1Gv-WZ_pMB1VQtX1xLFj-ETJg33razqLHCpoOzMcbb65ucw8jruZ_ltVmaO4bky9WmoFSXfgquEn8HVbLx_I02h0BDOXPBn61_jdnRYKSleCpfUR8G4pkEpsn592IvR3D3qgt0X/s1600/vercel-breach.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 12:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Vercel, Finds, More, Compromised, Accounts, Context.ai-Linked, Breach</media:keywords>
</item>

<item>
<title>Apple Patches iOS Flaw That Stored Deleted Signal Notifications in FBI Forensic Case</title>
<link>https://block385.com/apple-patches-ios-flaw-that-stored-deleted-signal-notifications-in-fbi-forensic-case</link>
<guid>https://block385.com/apple-patches-ios-flaw-that-stored-deleted-signal-notifications-in-fbi-forensic-case</guid>
<description><![CDATA[ Apple has rolled out a software fix for iOS and iPadOS to address a Notification Services flaw that stored notifications marked for deletion on the device.
The vulnerability, tracked as CVE-2026-28950 (CVSS score: N/A), has been described as a logging issue that has been addressed with improved data redaction.
&quot;Notifications marked for deletion could be unexpectedly retained on the device,&quot; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8iikjICH9h-OY06K3jZBcEcwtWEuusLcRgwG1T5SvE39V2ZfqSe7Z7N3NFXzfxgYicI_yo8bvme9f4RYazoU-5dUmoTKJMgdmW38AuWgFEWKNBTxgqQJAgpwZUOS926Ue1qCGUW7ou2wStgU-vRsle4Ky8pcp2I2mT_Sm3eyUw__JZaO-BrBZ80z3Zhvx/s1600/apple-signal.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 12:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, Patches, iOS, Flaw, That, Stored, Deleted, Signal, Notifications, FBI, Forensic, Case</media:keywords>
</item>

<item>
<title>OpenAI tackles a bad habit people have when interacting with AI</title>
<link>https://block385.com/openai-tackles-a-bad-habit-people-have-when-interacting-with-ai</link>
<guid>https://block385.com/openai-tackles-a-bad-habit-people-have-when-interacting-with-ai</guid>
<description><![CDATA[ Since people tend to paste personal data into AI tools such as ChatGPT, OpenAI has released Privacy Filter, an open-weight model designed to detect and redact personally identifiable information (PII) in text. The model is available under the Apache 2.0 license on Hugging Face and GitHub. “This release is part of our broader effort to support a more resilient software ecosystem by providing developers with practical infrastructure for building with AI safely, including tools and … More →
The post OpenAI tackles a bad habit people have when interacting with AI appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/05155719/openai-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 11:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI, tackles, bad, habit, people, have, when, interacting, with</media:keywords>
</item>

<item>
<title>Scenario: Open&#45;source framework for automated AI app red&#45;teaming</title>
<link>https://block385.com/scenario-open-source-framework-for-automated-ai-app-red-teaming</link>
<guid>https://block385.com/scenario-open-source-framework-for-automated-ai-app-red-teaming</guid>
<description><![CDATA[ Enterprises running customer service bots, data analytics agents, and other AI-driven applications in production handle sensitive records and connect to core business systems every day. LangWatch has released Scenario, an open-source framework that runs automated red-team exercises against AI agents using multi-turn attack techniques that mirror how adversaries operate in the wild. Multi-turn attacks replace single-shot testing Single-prompt penetration tests have long been the standard approach for probing LLMs. Models often hold firm against a … More →
The post Scenario: Open-source framework for automated AI app red-teaming appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22144039/scenario-ai-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 09:00:19 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Scenario:, Open-source, framework, for, automated, app, red-teaming</media:keywords>
</item>

<item>
<title>A year in, Zoom’s CISO reflects on balancing security and business</title>
<link>https://block385.com/a-year-in-zooms-ciso-reflects-on-balancing-security-and-business</link>
<guid>https://block385.com/a-year-in-zooms-ciso-reflects-on-balancing-security-and-business</guid>
<description><![CDATA[ In this Help Net Security interview, Sandra McLeod, CISO at Zoom, reflects on her first year in the role. She talks about moving from reactive firefighting to business strategy, and what she heard from engineers, the board, and customers during her early months. McLeod discusses how she prepared for incident management, the dual job of handling crises and explaining them afterward, and her experience as a woman in technical leadership at Zoom. She closes with … More →
The post A year in, Zoom’s CISO reflects on balancing security and business appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22090836/sandra_mcleod-2-zoom.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 09:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>year, in, Zoom’s, CISO, reflects, balancing, security, and, business</media:keywords>
</item>

<item>
<title>Ransomware, fraud, and lawsuits drive cyber insurance claims to new peaks</title>
<link>https://block385.com/ransomware-fraud-and-lawsuits-drive-cyber-insurance-claims-to-new-peaks</link>
<guid>https://block385.com/ransomware-fraud-and-lawsuits-drive-cyber-insurance-claims-to-new-peaks</guid>
<description><![CDATA[ The 2026 InsurSec Report from At-Bay, covering more than 100,000 policy years of claims data, documents a 7% year-over-year rise in overall claim frequency and an all-time high average severity of $221,000. Ransomware severity reached $508,000, up 16% from the prior year, making it the costliest incident type by a wide margin. Remote access weaknesses dominate ransomware entry Remote access services served as the entry point for 87% of ransomware claims in 2025, up from … More →
The post Ransomware, fraud, and lawsuits drive cyber insurance claims to new peaks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/16113804/person-computer-red-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 07:00:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ransomware, fraud, and, lawsuits, drive, cyber, insurance, claims, new, peaks</media:keywords>
</item>

<item>
<title>GDPR works, but only where someone enforces it</title>
<link>https://block385.com/gdpr-works-but-only-where-someone-enforces-it</link>
<guid>https://block385.com/gdpr-works-but-only-where-someone-enforces-it</guid>
<description><![CDATA[ A new measurement study of web tracking across ten countries offers a reality check for anyone working on privacy compliance. Researchers crawled the same set of globally popular websites from virtual machines located in Australia, Brazil, Canada, Germany, India, Singapore, South Africa, South Korea, Spain, and California. The results show that European privacy law does reduce tracking, and that most of the reduction happens in the two jurisdictions where regulators bring cases. The headline numbers … More →
The post GDPR works, but only where someone enforces it appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22103033/europe-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 07:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GDPR, works, but, only, where, someone, enforces</media:keywords>
</item>

<item>
<title>&amp;apos;The Gentlemen&amp;apos; Rapidly Rises to Ransomware Prominence</title>
<link>https://block385.com/the-gentlemen-rapidly-rises-to-ransomware-prominence</link>
<guid>https://block385.com/the-gentlemen-rapidly-rises-to-ransomware-prominence</guid>
<description><![CDATA[ Not nearly as polite as the name suggests, the ransomware gang has impressed researchers with its speed in scaling up operations — and its sophistication. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt9dfe08179358f99d/69e92147a425f3fc877c3bd4/Gentlemen_Sign_David_Morphew_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 01:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Gentlemen, Rapidly, Rises, Ransomware, Prominence</media:keywords>
</item>

<item>
<title>Google’s Workspace Intelligence promises privacy while running on your data</title>
<link>https://block385.com/googles-workspace-intelligence-promises-privacy-while-running-on-your-data</link>
<guid>https://block385.com/googles-workspace-intelligence-promises-privacy-while-running-on-your-data</guid>
<description><![CDATA[ Security and data governance are among the key considerations in Google’s latest AI update, which introduces Workspace Intelligence within Google Workspace. Google describes the feature as “a secure, dynamic system that inherently understands complex semantic relationships within your Workspace apps (such as Docs, Slides, or Gmail) content, your active projects, your collaborators, and your organization’s domain knowledge.” “Workspace Intelligence is built on the same reliable, secure, and compliant infrastructure as the rest of Workspace,” Yulie … More →
The post Google’s Workspace Intelligence promises privacy while running on your data appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22162448/google-workspace-intelligence.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 23:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google’s, Workspace, Intelligence, promises, privacy, while, running, your, data</media:keywords>
</item>

<item>
<title>Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain</title>
<link>https://block385.com/malicious-kics-docker-images-and-vs-code-extensions-hit-checkmarx-supply-chain</link>
<guid>https://block385.com/malicious-kics-docker-images-and-vs-code-extensions-hit-checkmarx-supply-chain</guid>
<description><![CDATA[ Cybersecurity researchers have warned of malicious images pushed to the official &quot;checkmarx/kics&quot; Docker Hub repository.
In an alert published today, software supply chain security company Socket revealed that unknown threat actors managed to have overwritten existing tags, including v2.1.20 and alpine, while also introducing a new v2.1.21 tag that does not correspond to an official release. The ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimocxAyADkuC5qBKZquZhHtUaDSArR1yrr0eRW7dQ_qo4yJpHxj2VYF0qQBxxYfhwOv5g3PJ6raoVwGHrns8DiRFppR_OPFhc2NUoVxlMc0W3fwVyR8J0daGZ_a8IOSuqL1kXJmY6Sj1bvqJ7OwkZfJQB2Cha4WldeRwCcAopoTllcER15ca3eFwsibt6i/s1600/kics.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 22:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Malicious, KICS, Docker, Images, and, Code, Extensions, Hit, Checkmarx, Supply, Chain</media:keywords>
</item>

<item>
<title>Self&#45;Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens</title>
<link>https://block385.com/self-propagating-supply-chain-worm-hijacks-npm-packages-to-steal-developer-tokens</link>
<guid>https://block385.com/self-propagating-supply-chain-worm-hijacks-npm-packages-to-steal-developer-tokens</guid>
<description><![CDATA[ Cybersecurity researchers have flagged a fresh set of packages that have been compromised by bad actors to deliver a self-propagating worm that spreads through stolen developer npm tokens.
The supply chain worm has been detected by both Socket and StepSecurity, with the companies tracking the activity under the name CanisterSprawl owing to the use of an ICP canister to exfiltrate the stolen data ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIdq7inTckksldfLXx5JPM1spcmvj-W0C5jvCNGSfvUlWfhmFERkPhE9WNRTkTib4uZFsKKn2lBvxnhsZbEaOnGKI4pkSKu8kpyBn7VEsY3BbVN5ZklAoliWNZC-b526mJbr5xiYxKwRFXB8pnV2K-H5ww5mG3_1GrWjgvrsnqJ2EJu1gZJ15-D29njRY9/s1600/npm.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Self-Propagating, Supply, Chain, Worm, Hijacks, npm, Packages, Steal, Developer, Tokens</media:keywords>
</item>

<item>
<title>Claude Mythos finds 271 Firefox flaws, Mozilla believes it shifts security toward defenders</title>
<link>https://block385.com/claude-mythos-finds-271-firefox-flaws-mozilla-believes-it-shifts-security-toward-defenders</link>
<guid>https://block385.com/claude-mythos-finds-271-firefox-flaws-mozilla-believes-it-shifts-security-toward-defenders</guid>
<description><![CDATA[ The Mozilla Foundation tested Claude Mythos, an Anthropic AI model that has stirred debate in the cybersecurity community. Before granting access to Mythos, Mozilla scanned Firefox using Opus 4.6, which led to fixes for 22 security-sensitive bugs in Firefox 148. For instance, Mythos identified 271 vulnerabilities in Firefox 150. Firefox CTO Bobby Holley said other teams are beginning to experience the same “vertigo” that Mozilla felt when the findings first came into focus. “For a … More →
The post Claude Mythos finds 271 Firefox flaws, Mozilla believes it shifts security toward defenders appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/07/16184414/firefox-2023.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 19:00:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, Mythos, finds, 271, Firefox, flaws, Mozilla, believes, shifts, security, toward, defenders</media:keywords>
</item>

<item>
<title>Cyberattack on French government agency triggers phishing alert</title>
<link>https://block385.com/cyberattack-on-french-government-agency-triggers-phishing-alert</link>
<guid>https://block385.com/cyberattack-on-french-government-agency-triggers-phishing-alert</guid>
<description><![CDATA[ France Titres, a French government agency, has disclosed a data breach that may have exposed user data from its online portal. France Titres, also known as the Agence nationale des titres sécurisés (ANTS), operates under the French Ministry of the Interior and manages systems for official identity and registration documents, including driver’s licences, national ID cards, passports, and immigration documents. According to the agency, the incident was detected on Wednesday, April 15, and remains under … More →
The post Cyberattack on French government agency triggers phishing alert appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22163101/france-titres-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 19:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cyberattack, French, government, agency, triggers, phishing, alert</media:keywords>
</item>

<item>
<title>Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API</title>
<link>https://block385.com/harvester-deploys-linux-gogra-backdoor-in-south-asia-using-microsoft-graph-api</link>
<guid>https://block385.com/harvester-deploys-linux-gogra-backdoor-in-south-asia-using-microsoft-graph-api</guid>
<description><![CDATA[ The threat actor known as Harvester has been attributed to a new Linux version of its GoGra backdoor deployed as part of attacks likely targeting entities in South Asia.
&quot;The malware uses the legitimate Microsoft Graph API and Outlook mailboxes as a covert command-and-control (C2) channel, allowing it to bypass traditional perimeter network defenses,&quot; the Symantec and Carbon Black Threat Hunter ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiptXaD_Im0Bee0znCFTtBnOBEGGfeP-lS85crmRfAsd5-sMOsHstg9jATLVQOSJF2tiQQ6qkQ2ZWK98foU4WIQU_tHja8H882jF-_oiA5UGh-iG0-ByeaGfBbjDGid-FkfsNfKQUljfBsgejRsHBiBeX1DXRbjf1ohM1uhZiKdsjpBaH_0lYylOWSA9itt/s1600/linux.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 18:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Harvester, Deploys, Linux, GoGra, Backdoor, South, Asia, Using, Microsoft, Graph, API</media:keywords>
</item>

<item>
<title>Acronis GenAI Protection gives MSPs control over AI usage and data risks</title>
<link>https://block385.com/acronis-genai-protection-gives-msps-control-over-ai-usage-and-data-risks</link>
<guid>https://block385.com/acronis-genai-protection-gives-msps-control-over-ai-usage-and-data-risks</guid>
<description><![CDATA[ Acronis has launced Acronis GenAI Protection, a monitoring and security solution that enables managed service providers (MSPs) to control generative AI usage across client environments, preventing sensitive data exposure and protecting against malicious prompt manipulation. Acronis GenAI Protection represents the initial phase of Acronis Cyber Workspace, with additional capabilities planned for release to deliver a protected AI workspace, natively integrated into the Acronis platform. As organisations rapidly adopt generative AI tools, businesses face growing risks … More →
The post Acronis GenAI Protection gives MSPs control over AI usage and data risks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 17:00:25 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Acronis, GenAI, Protection, gives, MSPs, control, over, usage, and, data, risks</media:keywords>
</item>

<item>
<title>New Mirai variants target routers and DVRs in parallel campaigns</title>
<link>https://block385.com/new-mirai-variants-target-routers-and-dvrs-in-parallel-campaigns</link>
<guid>https://block385.com/new-mirai-variants-target-routers-and-dvrs-in-parallel-campaigns</guid>
<description><![CDATA[ Hidden inside newly discovered botnet malware is an unusual message from its creator: “AI.NEEDS.TO.DIE”. Dubbed “tuxnokill” by researchers at Akamai, the malware is one of two fresh Mirai botnet variants documented this month by major cybersecurity firms and, judging by the aforementioned hard-coded string, this particular variant might have been coded the old-fashioned way. “Tuxnokill” and “Nexcorium” Based on hits on the company’s global network of honeypots, Akamai found that tuxnokill is spreading through CVE-2025-29635, … More →
The post New Mirai variants target routers and DVRs in parallel campaigns appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/23124652/attack-ddos-threat-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 17:00:21 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Mirai, variants, target, routers, and, DVRs, parallel, campaigns</media:keywords>
</item>

<item>
<title>Prove Identity Platform connects verification, authentication, and fraud prevention</title>
<link>https://block385.com/prove-identity-platform-connects-verification-authentication-and-fraud-prevention</link>
<guid>https://block385.com/prove-identity-platform-connects-verification-authentication-and-fraud-prevention</guid>
<description><![CDATA[ Prove has launched the Prove Identity Platform, turning identity verification into an ongoing, real-time process for users, businesses, and AI agents. AI agents are already initiating real transactions on behalf of real people. OpenAI and Stripe launched the Agentic Commerce Protocol in September. Visa named Anthropic, OpenAI, and Perplexity as agentic commerce partners. As that shift accelerates, the central question facing every organization becomes: Is this person real, and did they authorize this specific action, … More →
The post Prove Identity Platform connects verification, authentication, and fraud prevention appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 17:00:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Prove, Identity, Platform, connects, verification, authentication, and, fraud, prevention</media:keywords>
</item>

<item>
<title>Claude Mythos finds 271 Firefox flaws, Mozilla believes zero&#45;days are numbered</title>
<link>https://block385.com/claude-mythos-finds-271-firefox-flaws-mozilla-believes-zero-days-are-numbered</link>
<guid>https://block385.com/claude-mythos-finds-271-firefox-flaws-mozilla-believes-zero-days-are-numbered</guid>
<description><![CDATA[ The Mozilla Foundation tested Claude Mythos, an Anthropic AI model that has stirred debate in the cybersecurity community. Before granting access to Mythos, Mozilla scanned Firefox using Opus 4.6, which led to fixes for 22 security-sensitive bugs in Firefox 148. For instance, Mythos identified 271 vulnerabilities in Firefox 150. Firefox CTO Bobby Holley said other teams are beginning to experience the same “vertigo” that Mozilla felt when the findings first came into focus. “For a … More →
The post Claude Mythos finds 271 Firefox flaws, Mozilla believes zero-days are numbered appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/07/16184414/firefox-2023.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 17:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, Mythos, finds, 271, Firefox, flaws, Mozilla, believes, zero-days, are, numbered</media:keywords>
</item>

<item>
<title>DPRK Fake Job Scams Self&#45;Propagate in &amp;apos;Contagious Interview&amp;apos;</title>
<link>https://block385.com/dprk-fake-job-scams-self-propagate-in-contagious-interview</link>
<guid>https://block385.com/dprk-fake-job-scams-self-propagate-in-contagious-interview</guid>
<description><![CDATA[ A compromised developer&#039;s repository serves as a worm-like infection vector to spread remote access Trojans (RATs) and other malware. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3fce2e5014a4ecec/694ad7a0ec1580176ac05f87/DPRK_Square_Ian_Cowe_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 17:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DPRK, Fake, Job, Scams, Self-Propagate, Contagious, Interview</media:keywords>
</item>

<item>
<title>Progress Software fixes sneaky WAF bypass vulnerability (CVE&#45;2026&#45;21876)</title>
<link>https://block385.com/progress-software-fixes-sneaky-waf-bypass-vulnerability-cve-2026-21876</link>
<guid>https://block385.com/progress-software-fixes-sneaky-waf-bypass-vulnerability-cve-2026-21876</guid>
<description><![CDATA[ Progress Software has fixed a slew of high-severity vulnerabilities in MOVEit WAF and LoadMaster, including a flaw (CVE-2026-21876) that may allow attackers to bypass firewall detection. MOVEit WAF (web application firewall) is designed to protect Progress’s managed file transfer platform MOVEit Transfer from web-based attacks. (A zero-day vulnerability in MOVEit Transfer was infamously exploited in 2023 by the Cl0p cyber extortion gang to grab data from hundreds of organizations.) LoadMaster is the company’s general-purpose enterprise … More →
The post Progress Software fixes sneaky WAF bypass vulnerability (CVE-2026-21876) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/06/12085541/progress-cyber1.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 15:00:20 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Progress, Software, fixes, sneaky, WAF, bypass, vulnerability, CVE-2026-21876</media:keywords>
</item>

<item>
<title>Elastic MCP Apps bring security and observability workflows into AI tools</title>
<link>https://block385.com/elastic-mcp-apps-bring-security-and-observability-workflows-into-ai-tools</link>
<guid>https://block385.com/elastic-mcp-apps-bring-security-and-observability-workflows-into-ai-tools</guid>
<description><![CDATA[ Elastic has announced MCP Apps for Elastic, delivering agent-native UI experiences for security and observability workflows across third-party coding tools and chat clients. The new MCP Apps enable teams to investigate threats, diagnose system behavior, and act on data directly within the AI tools they already use, without switching tools or stitching together separate systems. Built on the Model Context Protocol (MCP) apps spec, the open standard co-authored by Anthropic and OpenAI, these apps allow … More →
The post Elastic MCP Apps bring security and observability workflows into AI tools appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 15:00:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Elastic, MCP, Apps, bring, security, and, observability, workflows, into, tools</media:keywords>
</item>

<item>
<title>Lotus Wiper Malware Targets Venezuelan Energy Systems in Destructive Attack</title>
<link>https://block385.com/lotus-wiper-malware-targets-venezuelan-energy-systems-in-destructive-attack</link>
<guid>https://block385.com/lotus-wiper-malware-targets-venezuelan-energy-systems-in-destructive-attack</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a previously undocumented data wiper that has been used in attacks targeting Venezuela at the end of last year and the start of 2026.
Dubbed Lotus Wiper, the novel file wiper has been used in a destructive campaign targeting the energy and utilities sector in Venezuela, per findings from Kaspersky.
&quot;Two batch scripts are responsible for initiating the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhANfDCr_4asg41Zj98h_tyRYig7XZGWHyCgPXHcVUvax_31CDUNrmrUp9rBFZK0u0Ai97i5pUlapu4ePRoBQAzvxt-KX3u80dTOjzyPPOOGzuCUmBZgaczzHisujoEXmfO08HtxqTbkAYBRI7JdBKffmATJHHM4uDe2RDsPyC11CkgenulBnQ7ZhyH8m-t/s1600/wiper-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Lotus, Wiper, Malware, Targets, Venezuelan, Energy, Systems, Destructive, Attack</media:keywords>
</item>

<item>
<title>Toxic Combinations: When Cross&#45;App Permissions Stack into Risk</title>
<link>https://block385.com/toxic-combinations-when-cross-app-permissions-stack-into-risk</link>
<guid>https://block385.com/toxic-combinations-when-cross-app-permissions-stack-into-risk</guid>
<description><![CDATA[ On January 31, 2026, researchers disclosed that Moltbook, a social network built for AI agents, had left its database wide open, exposing 35,000 email addresses and 1.5 million agent API tokens across 770,000 active agents.
The more worrying part sat inside the private messages. Some of those conversations held plaintext third-party credentials, including OpenAI API keys shared between agents, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeaSL6v6uahfzJpHJb0ATKZ7cbexnfYIayT74IyU1S-7f3T-4gfnWowlobm5RH4ZYrsIdeNq_OOHGxp2LbU-aELaO9RbYa15MfKN38-ZQPGhrgH0PYCsVIucG95SSw-WCzzo9eUhITn4A3txsa8H59XhTcAaOObC0r-Es_7i0RH8aDo_qhZ45MfaOTVF2t/s1600/reco.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Toxic, Combinations:, When, Cross-App, Permissions, Stack, into, Risk</media:keywords>
</item>

<item>
<title>OneDrive updates focus on AI, access control, and compliance</title>
<link>https://block385.com/onedrive-updates-focus-on-ai-access-control-and-compliance</link>
<guid>https://block385.com/onedrive-updates-focus-on-ai-access-control-and-compliance</guid>
<description><![CDATA[ Microsoft OneDrive’s recent updates focus on improving intelligence, collaboration, and administrative control. “Last year, we made a promise: your files should work for you, not the other way around. That meant reimagining OneDrive not just as a place to store files, but as an intelligent layer that surfaces what matters, eliminates busy work, and enables seamless collaboration across your organization. OneDrive became smarter, more collaborative, and more central to how work flows across Microsoft 365,” … More →
The post OneDrive updates focus on AI, access control, and compliance appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22082924/onedrive-logo-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 13:00:21 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OneDrive, updates, focus, AI, access, control, and, compliance</media:keywords>
</item>

<item>
<title>Phishing reclaims the top initial access spot, attackers experiment with AI tools</title>
<link>https://block385.com/phishing-reclaims-the-top-initial-access-spot-attackers-experiment-with-ai-tools</link>
<guid>https://block385.com/phishing-reclaims-the-top-initial-access-spot-attackers-experiment-with-ai-tools</guid>
<description><![CDATA[ Phishing returned as the leading method attackers used to break into organizations in the first quarter of 2026, accounting for over a third of engagements where initial access could be determined, according to Cisco Talos. It is the first quarter phishing has led the category since Q2 2025, when exploitation of public-facing applications took over following widespread attacks against on-premises Microsoft SharePoint servers. That SharePoint exploitation wave, collectively tracked as ToolShell, drove public-facing application exploitation … More →
The post Phishing reclaims the top initial access spot, attackers experiment with AI tools appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/05/18153305/phishing-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 13:00:18 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Phishing, reclaims, the, top, initial, access, spot, attackers, experiment, with, tools</media:keywords>
</item>

<item>
<title>Tencent’s QClaw AI agent app arrives on Windows and macOS</title>
<link>https://block385.com/tencents-qclaw-ai-agent-app-arrives-on-windows-and-macos</link>
<guid>https://block385.com/tencents-qclaw-ai-agent-app-arrives-on-windows-and-macos</guid>
<description><![CDATA[ Tencent has opened an international beta of QClaw, an AI agent application aimed at consumers in Canada, Japan, Singapore, South Korea, and the United States. The first wave is capped at 20,000 users. Additional markets are scheduled to follow. QClaw runs on Windows and MacOS. Setup takes about three minutes and involves downloading the application, registering an account, and scanning a QR code. The software is built on OpenClaw, the open-source personal AI assistant project. … More →
The post Tencent’s QClaw AI agent app arrives on Windows and macOS appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22122919/qclaw-1400.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 13:00:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tencent’s, QClaw, agent, app, arrives, Windows, and, macOS</media:keywords>
</item>

<item>
<title>Microsoft Patches Critical ASP.NET Core CVE&#45;2026&#45;40372 Privilege Escalation Bug</title>
<link>https://block385.com/microsoft-patches-critical-aspnet-core-cve-2026-40372-privilege-escalation-bug</link>
<guid>https://block385.com/microsoft-patches-critical-aspnet-core-cve-2026-40372-privilege-escalation-bug</guid>
<description><![CDATA[ Microsoft has released out-of-band updates to address a security vulnerability in ASP.NET Core that could allow an attacker to escalate privileges.
The vulnerability, tracked as CVE-2026-40372, carries a CVSS score of 9.1 out of 10.0. It&#039;s rated Important in severity. An anonymous researcher has been credited with discovering and reporting the flaw.
&quot;Improper verification of cryptographic ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYMuDYXH3vQ6ycJCKfikptBR0jdQdnf-s36gDb0LYx3gvMwQOQLrt072KY5GZ0T2GRhyphenhyphenrfIg5qcCqjE0J_PtKQ1P409j_veWwKYoGsGssQcTotxI2-Dl8akDSyPif_j4LgFL3kWI6pvWKX5QBjsnIZIHdFzlAIRgxspuS4W0Ywe-Z63zmIyL7X39CG_3Ng/s1600/dotnet.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 12:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Patches, Critical, ASP.NET, Core, CVE-2026-40372, Privilege, Escalation, Bug</media:keywords>
</item>

<item>
<title>Mustang Panda’s New LOTUSLITE Variant Targets India Banks, South Korea Policy Circles</title>
<link>https://block385.com/mustang-pandas-new-lotuslite-variant-targets-india-banks-south-korea-policy-circles</link>
<guid>https://block385.com/mustang-pandas-new-lotuslite-variant-targets-india-banks-south-korea-policy-circles</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a new variant of a known malware called LOTUSLITE that&#039;s distributed via a theme related to India&#039;s banking sector.
&quot;The backdoor communicates with a dynamic DNS-based command-and-control server over HTTPS and supports remote shell access, file operations, and session management, indicating a continued espionage-focused capability set rather than ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQHPkb7rlS_ueovJaV3s5KxgSQFfHhuZhvW8R8L9wG8j-trZvnmusj4EGvkOPah_XSqgJDLIiRWozv7RtA3o_1VaHYWnaH77PH2kOg2FYkc60uIc6WTf6frjbUp3IwhtB038_wojAl7G5OxcC4aSy5kLF48ssz_3xqLCD7bDbg6_i-RdY8tLvjxlj4Xc0o/s1600/indian-banks.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mustang, Panda’s, New, LOTUSLITE, Variant, Targets, India, Banks, South, Korea, Policy, Circles</media:keywords>
</item>

<item>
<title>Cohere AI Terrarium Sandbox Flaw Enables Root Code Execution, Container Escape</title>
<link>https://block385.com/cohere-ai-terrarium-sandbox-flaw-enables-root-code-execution-container-escape</link>
<guid>https://block385.com/cohere-ai-terrarium-sandbox-flaw-enables-root-code-execution-container-escape</guid>
<description><![CDATA[ A critical security vulnerability has been disclosed in a Python-based sandbox called Terrarium that could result in arbitrary code execution.
The vulnerability, tracked as CVE-2026-5752, is rated 9.3 on the CVSS scoring system.
&quot;Sandbox escape vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal,&quot; according to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjQ3NMjiDO5jGFykZtDgbq7FvB0nT8CMXMucn5cumu_V80blg8Wt6cklpQnCeG-EuX6oGvqmQKRJxFlmynTBatMk0zgDDsdurGDcs5rXScEF_jVNV10bEqJSJcj5YsAtLS_Pag8LRPrUZr4w9M-JJldxaYYMxtf3zrGia8QjUq-PtjLk_g4-qkkINXx4uGY/s1600/sandbox.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cohere, Terrarium, Sandbox, Flaw, Enables, Root, Code, Execution, Container, Escape</media:keywords>
</item>

<item>
<title>Shadow AI, deepfakes, and supply chain compromise are rewriting the financial sector threat playbook</title>
<link>https://block385.com/shadow-ai-deepfakes-and-supply-chain-compromise-are-rewriting-the-financial-sector-threat-playbook</link>
<guid>https://block385.com/shadow-ai-deepfakes-and-supply-chain-compromise-are-rewriting-the-financial-sector-threat-playbook</guid>
<description><![CDATA[ Financially motivated attacks continued to drive the bulk of cyber incidents against banks, insurers, and payment processors in 2025. Approximately 90% of breaches affecting financial institutions carried a financial motive, with data breaches accounting for roughly 64% of incidents and ransomware making up the remaining 36%. The average cost of a data breach in the sector reached $5.56 million per incident, placing finance second among all industries by breach cost. Personal data was the most … More →
The post Shadow AI, deepfakes, and supply chain compromise are rewriting the financial sector threat playbook appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/21151402/vault-blue-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 09:00:19 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Shadow, AI, deepfakes, and, supply, chain, compromise, are, rewriting, the, financial, sector, threat, playbook</media:keywords>
</item>

<item>
<title>Apple Intelligence flaw kept stolen tokens reusable on another device</title>
<link>https://block385.com/apple-intelligence-flaw-kept-stolen-tokens-reusable-on-another-device</link>
<guid>https://block385.com/apple-intelligence-flaw-kept-stolen-tokens-reusable-on-another-device</guid>
<description><![CDATA[ Apple claims that Apple Intelligence, a GenAI service provided on its operating systems, is designed with an extra focus on user security and privacy through a two-stage authentication and authorization system using anonymous access tokens. However, researchers from The Ohio State University have identified vulnerabilities in this design, demonstrated on macOS 26.0 (Tahoe), that allow attackers to steal and reuse these tokens. Service infrastructure The system offloads complex requests to cloud servers using Private Cloud … More →
The post Apple Intelligence flaw kept stolen tokens reusable on another device appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/21204126/apple-intelligence-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 09:00:17 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, Intelligence, flaw, kept, stolen, tokens, reusable, another, device</media:keywords>
</item>

<item>
<title>PentAGI: Open&#45;source autonomous AI penetration testing system</title>
<link>https://block385.com/pentagi-open-source-autonomous-ai-penetration-testing-system</link>
<guid>https://block385.com/pentagi-open-source-autonomous-ai-penetration-testing-system</guid>
<description><![CDATA[ Penetration testers have long relied on collections of specialized tools, manual coordination, and documented runbooks to work through a target assessment. PentAGI, an open-source project from VXControl, attempts to automate that entire workflow using a multi-agent AI system that plans, researches, and executes penetration tests with minimal human direction. How the agent system works PentAGI organizes work into a hierarchy of flows, tasks, subtasks, and actions. An orchestrator agent receives a goal and coordinates three … More →
The post PentAGI: Open-source autonomous AI penetration testing system appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16131911/pentagi-1400.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 09:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>PentAGI:, Open-source, autonomous, penetration, testing, system</media:keywords>
</item>

<item>
<title>Ransomware Negotiator Pleads Guilty to BlackCat Scheme</title>
<link>https://block385.com/ransomware-negotiator-pleads-guilty-to-blackcat-scheme</link>
<guid>https://block385.com/ransomware-negotiator-pleads-guilty-to-blackcat-scheme</guid>
<description><![CDATA[ A cautionary tale illustrates why the person negotiating should never be involved with any part of the ransom payment process, experts noted. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blta6fb987cb0bb58ed/69e7dd3f2efc0b3c473984ab/insider_threat_Cagkan_Sayin_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 01:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ransomware, Negotiator, Pleads, Guilty, BlackCat, Scheme</media:keywords>
</item>

<item>
<title>Thunderbird 150 arrives with encrypted message search and OpenPGP improvements</title>
<link>https://block385.com/thunderbird-150-arrives-with-encrypted-message-search-and-openpgp-improvements</link>
<guid>https://block385.com/thunderbird-150-arrives-with-encrypted-message-search-and-openpgp-improvements</guid>
<description><![CDATA[ Released today, Thunderbird 150.0 brings eight new features, a round of bug fixes, and security patches that cover the web engine underlying the email client. Thunderbird 150.0 runs on Windows 10 or later, macOS 10.15 or later, and Linux with GTK+ 3.14 or higher. Encrypted email gets more useful Two of the most notable additions in this release touch how users interact with encrypted mail. Thunderbird 150.0 adds message body search for OpenPGP and S/MIME … More →
The post Thunderbird 150 arrives with encrypted message search and OpenPGP improvements appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/21211406/thunderbird-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 23:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Thunderbird, 150, arrives, with, encrypted, message, search, and, OpenPGP, improvements</media:keywords>
</item>

<item>
<title>Exploits Turn Windows Defender into Attacker Tool</title>
<link>https://block385.com/exploits-turn-windows-defender-into-attacker-tool</link>
<guid>https://block385.com/exploits-turn-windows-defender-into-attacker-tool</guid>
<description><![CDATA[ Three proof-of-concept exploits are being used in active attacks against Microsoft&#039;s built-in security platform; two are unpatched. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4525b1bf0b3427d5/69e7b7f7df45795969187014/defender_aileenchik_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 23:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Exploits, Turn, Windows, Defender, into, Attacker, Tool</media:keywords>
</item>

<item>
<title>SystemBC C2 Server Reveals 1,570+ Victims in The Gentlemen Ransomware Operation</title>
<link>https://block385.com/systembc-c2-server-reveals-1570-victims-in-the-gentlemen-ransomware-operation</link>
<guid>https://block385.com/systembc-c2-server-reveals-1570-victims-in-the-gentlemen-ransomware-operation</guid>
<description><![CDATA[ Threat actors associated with The Gentlemen ransomware‑as‑a‑service (RaaS) operation have been observed attempting to deploy a known proxy malware called SystemBC.
According to new research published by Check Point, the command-and-control (C2 or C&amp;C) server linked to SystemBC has led to the discovery of a botnet of more than 1,570 victims.
&quot;SystemBC establishes SOCKS5 network tunnels within ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilP_Mn9bBsagBDSKxEcqQsy6typf-qNaLt59kGWS1jLvc22Z9AC8lY93_TZaBAUN3bx7PHgaGX8xfPIIipQgGZd5DViTIHxpnAS2mJj4X9EfkFWwlwPznOEgqu38CmzzUa4y4jUh6x0RBMkCG7AwRwLU6PhLNbbnOO1bq5sJxGVIy0GZije7IuCYZNuS4C/s1600/botnet.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 22:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SystemBC, Server, Reveals, 1, 570, Victims, The, Gentlemen, Ransomware, Operation</media:keywords>
</item>

<item>
<title>Ransomware negotiator admits role in attacks he was hired to resolve</title>
<link>https://block385.com/ransomware-negotiator-admits-role-in-attacks-he-was-hired-to-resolve</link>
<guid>https://block385.com/ransomware-negotiator-admits-role-in-attacks-he-was-hired-to-resolve</guid>
<description><![CDATA[ A Florida man, formerly employed as a ransomware negotiator, pleaded guilty to conspiring to carry out ransomware attacks against US companies. Prosecutors say Angelo Martino, 41, used his position at DigitalMint, a crypto broker that helps victims negotiate and pay ransomware demands, to pass sensitive information to attackers. Alongside Martino, two more individuals were involved in the scheme: Ryan Goldberg of Georgia and Kevin Martin of Texas. All three men worked in the cybersecurity industry … More →
The post Ransomware negotiator admits role in attacks he was hired to resolve appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/02133805/ransomware-skull.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 21:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ransomware, negotiator, admits, role, attacks, was, hired, resolve</media:keywords>
</item>

<item>
<title>VirtualBox 7.2.8 is out with Linux kernel 7.0 support and crash fixes</title>
<link>https://block385.com/virtualbox-728-is-out-with-linux-kernel-70-support-and-crash-fixes</link>
<guid>https://block385.com/virtualbox-728-is-out-with-linux-kernel-70-support-and-crash-fixes</guid>
<description><![CDATA[ Oracle shipped VirtualBox 7.2.8 on April 21, 2026, as a maintenance release covering crashes, networking problems, clipboard issues, and extended Linux kernel compatibility. The update touches the VMM layer, NAT networking, graphics, UEFI, and both Linux and Windows guest support. VMM and core stability A Guru Meditation error carrying the code VERR_IEM_IPE_4 is fixed in this release. The condition occurred when a guest attempted to execute the wrong hypercall instruction and injected an undefined instruction … More →
The post VirtualBox 7.2.8 is out with Linux kernel 7.0 support and crash fixes appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/21201552/virtualbox-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 21:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>VirtualBox, 7.2.8, out, with, Linux, kernel, 7.0, support, and, crash, fixes</media:keywords>
</item>

<item>
<title>Surge in Bomgar RMM Exploitation Demonstrates Supply Chain Risk</title>
<link>https://block385.com/surge-in-bomgar-rmm-exploitation-demonstrates-supply-chain-risk</link>
<guid>https://block385.com/surge-in-bomgar-rmm-exploitation-demonstrates-supply-chain-risk</guid>
<description><![CDATA[ The critical remote code execution flaw (CVE-2026-1731) in the remote monitoring and management tool can be exploited to spread ransomware and compromise supply chains. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt45973c33b8514dc7/69e6020c564106783a09ab08/sharks_swimming_around_computer_artpartner-images.com_Alamy.png" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 21:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Surge, Bomgar, RMM, Exploitation, Demonstrates, Supply, Chain, Risk</media:keywords>
</item>

<item>
<title>22 BRIDGE:BREAK Flaws Expose Thousands of Lantronix and Silex Serial&#45;to&#45;IP Converters</title>
<link>https://block385.com/22-bridgebreak-flaws-expose-thousands-of-lantronix-and-silex-serial-to-ip-converters</link>
<guid>https://block385.com/22-bridgebreak-flaws-expose-thousands-of-lantronix-and-silex-serial-to-ip-converters</guid>
<description><![CDATA[ Cybersecurity researchers have identified 22 new vulnerabilities in popular models of serial-to-IP converters from Lantronix and Silex that could be exploited to hijack susceptible devices and tamper with data exchanged by them.
The vulnerabilities have been collectively codenamed BRIDGE:BREAK by Forescout Research Vedere Labs, which identified nearly 20,000 Serial-to-Ethernet converters exposed ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguDEDMst3MIdrJaNrbo9p_7mjaF2nB_5UuQZR2JhNRNPw8h619BhPWYUZ0yYD-ix_jIluuAwjip4ho4huSuYqr4lXcperdn-4_tFKZ6yivKeOuDJd9O-1EDiwIvD1sPwRGL6keOFr5muqqXp2GWdOlpmi9_uQyREP_iiEz0ZoX-W4ACBSxYarYPb4CJTIY/s1600/hardware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 20:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>BRIDGE:BREAK, Flaws, Expose, Thousands, Lantronix, and, Silex, Serial-to-IP, Converters</media:keywords>
</item>

<item>
<title>22 BRIDGE:BREAK Flaws Expose 20,000 Lantronix and Silex Serial&#45;to&#45;IP Converters</title>
<link>https://block385.com/22-bridgebreak-flaws-expose-20000-lantronix-and-silex-serial-to-ip-converters</link>
<guid>https://block385.com/22-bridgebreak-flaws-expose-20000-lantronix-and-silex-serial-to-ip-converters</guid>
<description><![CDATA[ Cybersecurity researchers have identified 22 new vulnerabilities in popular models of serial-to-IP converters from Lantronix and Silex that could be exploited to hijack susceptible devices and tamper with data exchanged by them.
The vulnerabilities have been collectively codenamed BRIDGE:BREAK by Forescout Research Vedere Labs, which identified nearly 20,000 Serial-to-Ethernet converters exposed ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguDEDMst3MIdrJaNrbo9p_7mjaF2nB_5UuQZR2JhNRNPw8h619BhPWYUZ0yYD-ix_jIluuAwjip4ho4huSuYqr4lXcperdn-4_tFKZ6yivKeOuDJd9O-1EDiwIvD1sPwRGL6keOFr5muqqXp2GWdOlpmi9_uQyREP_iiEz0ZoX-W4ACBSxYarYPb4CJTIY/s1600/hardware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 18:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>BRIDGE:BREAK, Flaws, Expose, 20, 000, Lantronix, and, Silex, Serial-to-IP, Converters</media:keywords>
</item>

<item>
<title>Ransomware Negotiator Pleads Guilty to Aiding BlackCat Attacks in 2023</title>
<link>https://block385.com/ransomware-negotiator-pleads-guilty-to-aiding-blackcat-attacks-in-2023</link>
<guid>https://block385.com/ransomware-negotiator-pleads-guilty-to-aiding-blackcat-attacks-in-2023</guid>
<description><![CDATA[ A third individual who was employed as a ransomware negotiator has pleaded guilty to conducting ransomware attacks against U.S. companies in 2023.
Angelo Martino, 41, of Land O&#039;Lakes, Florida, teamed up with the operators of the BlackCat ransomware starting in April 2023 to assist the e-crime gang in extracting higher amounts as ransoms.
&quot;Working as a negotiator on behalf of five different ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhau3OWhO8rBZT2xz8xcZ90Y8tYMmkZCI81G0GGeUkEHBQi4HzltJJJkzdQr6YS-4R8kZKSAf6Dc9YT6ifgHjmdQSpBvRgJbkEvzIW1dy57LQHQBJkc0YXS3zdYy6TTH8rklsIUGX32R0nk3hBrcYt804nqjBOND_ighh-SHyHHHBt-sJhfOszExZfVmwW8/s1600/ransomware-hacker.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 18:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ransomware, Negotiator, Pleads, Guilty, Aiding, BlackCat, Attacks, 2023</media:keywords>
</item>

<item>
<title>Scattered Spider hacker pleads guilty to stealing $8 million in cryptocurrency</title>
<link>https://block385.com/scattered-spider-hacker-pleads-guilty-to-stealing-8-million-in-cryptocurrency</link>
<guid>https://block385.com/scattered-spider-hacker-pleads-guilty-to-stealing-8-million-in-cryptocurrency</guid>
<description><![CDATA[ A British national tied to the Scattered Spider cybercrime group pleaded guilty to hacking multiple companies via SMS phishing and stealing over $8 million in virtual currency from US victims. Tyler Robert Buchanan, 24, of Dundee, Scotland, pleaded guilty to conspiracy to commit wire fraud and aggravated identity theft. In November 2024, US authorities unsealed criminal charges against Buchanan and four other alleged members of the Scattered Spider group, accusing them of using phishing text … More →
The post Scattered Spider hacker pleads guilty to stealing $8 million in cryptocurrency appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/06/25143238/cyber-threat1.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 17:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Scattered, Spider, hacker, pleads, guilty, stealing, million, cryptocurrency</media:keywords>
</item>

<item>
<title>Google Fixes Critical RCE Flaw in AI&#45;Based Antigravity Tool</title>
<link>https://block385.com/google-fixes-critical-rce-flaw-in-ai-based-antigravity-tool</link>
<guid>https://block385.com/google-fixes-critical-rce-flaw-in-ai-based-antigravity-tool</guid>
<description><![CDATA[ The prompt injection vulnerability in the agentic AI product for filesystem operations was a sanitization issue that allowed for sandbox escape and arbitrary code execution. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt603689f53740e77f/69e758abcb63e88a3d9bab05/AI(1800)_NicoElNino_Alamy.png" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Fixes, Critical, RCE, Flaw, AI-Based, Antigravity, Tool</media:keywords>
</item>

<item>
<title>5 Places where Mature SOCs Keep MTTR Fast and Others Waste Time</title>
<link>https://block385.com/5-places-where-mature-socs-keep-mttr-fast-and-others-waste-time</link>
<guid>https://block385.com/5-places-where-mature-socs-keep-mttr-fast-and-others-waste-time</guid>
<description><![CDATA[ Security teams often present MTTR as an internal KPI. Leadership sees it differently: every hour a threat dwells inside the environment is an hour of potential data exfiltration, service disruption, regulatory exposure, and brand damage. 
The root cause of slow MTTR is almost never &quot;not enough analysts.&quot; It is almost always the same structural problem: threat intelligence that exists ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZct3ObvKWOQuvm1iZXNZ2nc7pHglILHvCbnLW1HDwUNdkgjuBap_OEBwgsXuxXBkIqmlYLgcccvPt28Knlm3jG5B3MOsXk40-bBUlhVLU3BqjWwSlxuSbiyfwHj-S15tikmwmgH37VhkaM5lMC2sL7bod_uOo0VxatuOekhYxdmkci38SzbsnZHkN-ho/s1600/boosters.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 16:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Places, where, Mature, SOCs, Keep, MTTR, Fast, and, Others, Waste, Time</media:keywords>
</item>

<item>
<title>CISA flags another Cisco Catalyst SD&#45;WAN Manager bug as exploited (CVE&#45;2026&#45;20133)</title>
<link>https://block385.com/cisa-flags-another-cisco-catalyst-sd-wan-manager-bug-as-exploited-cve-2026-20133</link>
<guid>https://block385.com/cisa-flags-another-cisco-catalyst-sd-wan-manager-bug-as-exploited-cve-2026-20133</guid>
<description><![CDATA[ CISA added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including a Cisco Catalyst SD-WAN Manager vulnerability (CVE-2026-20133) that Cisco has yet to flag as exploited. Three Cisco Catalyst SD-WAN Manager vulnerabilities Alongside CVE-2026-20133, CISA has also listed CVE-2026-20128 and CVE-2026-20122 – two other Catalyst SD-WAN Manager vulnerabilities – as being leveraged in attacks. The latter two flaws have been confirmed as actively exploited by Cisco in early March 2026. In March, VulnCheck’s … More →
The post CISA flags another Cisco Catalyst SD-WAN Manager bug as exploited (CVE-2026-20133) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/06151815/cisco-1500-hands.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 15:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, flags, another, Cisco, Catalyst, SD-WAN, Manager, bug, exploited, CVE-2026-20133</media:keywords>
</item>

<item>
<title>OpenAI’s Chronicle feature lets Codex read your screen, raising privacy concerns</title>
<link>https://block385.com/openais-chronicle-feature-lets-codex-read-your-screen-raising-privacy-concerns</link>
<guid>https://block385.com/openais-chronicle-feature-lets-codex-read-your-screen-raising-privacy-concerns</guid>
<description><![CDATA[ OpenAI’s Chronicle is a feature designed to help Codex, an AI-powered coding assistant, better understand what users are working on by capturing context directly from their screens. It uses recent screen activity to build memories, allowing Codex to interpret references, identify relevant sources, and pick up on the tools and workflows users rely on, without requiring them to restate context in every prompt. “In these cases, Codex uses Chronicle to provide additional context. When another … More →
The post OpenAI’s Chronicle feature lets Codex read your screen, raising privacy concerns appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/05155719/openai-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 15:00:24 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI’s, Chronicle, feature, lets, Codex, read, your, screen, raising, privacy, concerns</media:keywords>
</item>

<item>
<title>Silobreaker Mimir adds agentic AI to intelligence workflows with governance and transparency</title>
<link>https://block385.com/silobreaker-mimir-adds-agentic-ai-to-intelligence-workflows-with-governance-and-transparency</link>
<guid>https://block385.com/silobreaker-mimir-adds-agentic-ai-to-intelligence-workflows-with-governance-and-transparency</guid>
<description><![CDATA[ Silobreaker has announced new agentic AI capabilities that combine faster research and deeper contextual analysis with built-in governance and transparency to ensure trusted intelligence can be safely consumed across the wider enterprise. Silobreaker Mimir is an embedded agentic capability for intelligence operations, working directly within the analyst workflow. It helps teams retrieve evidence, deepen analysis, and turn validated findings into native assets and stakeholder ready outputs, such as creating dashboards and reports, without leaving the … More →
The post Silobreaker Mimir adds agentic AI to intelligence workflows with governance and transparency appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 15:00:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Silobreaker, Mimir, adds, agentic, intelligence, workflows, with, governance, and, transparency</media:keywords>
</item>

<item>
<title>Ivanti Neurons AI automates IT operations, reducing manual work and security risk</title>
<link>https://block385.com/ivanti-neurons-ai-automates-it-operations-reducing-manual-work-and-security-risk</link>
<guid>https://block385.com/ivanti-neurons-ai-automates-it-operations-reducing-manual-work-and-security-risk</guid>
<description><![CDATA[ Ivanti has revealed new solution capabilities, focusing on enabling autonomous IT operations and organizations to secure their environments more efficiently at scale. With these advancements, Ivanti enables IT and security operations to detect, decide, and act autonomously without sacrificing trust, governance, or control. AI capabilities and the threat landscape are changing quickly, and IT and security teams are under constant pressure to keep systems secure while supporting day-to-day work. That means more devices to manage, … More →
The post Ivanti Neurons AI automates IT operations, reducing manual work and security risk appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 15:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ivanti, Neurons, automates, operations, reducing, manual, work, and, security, risk</media:keywords>
</item>

<item>
<title>Chinese APT Targets Indian Banks, Korean Policy Circles</title>
<link>https://block385.com/chinese-apt-targets-indian-banks-korean-policy-circles</link>
<guid>https://block385.com/chinese-apt-targets-indian-banks-korean-policy-circles</guid>
<description><![CDATA[ China is spying on India&#039;s financial sector, for some reason, and it&#039;s not putting much effort into it, judging by some stale TTPs. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltbcf944fb9a38a8ce/69e680b5c3e9c2d5dd27d590/China_India_Korea-Wirestock_Inc.-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 15:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Chinese, APT, Targets, Indian, Banks, Korean, Policy, Circles</media:keywords>
</item>

<item>
<title>Serial&#45;to&#45;IP Devices Hide Thousands of Old &amp;amp;amp; New Bugs</title>
<link>https://block385.com/serial-to-ip-devices-hide-thousands-of-old-new-bugs</link>
<guid>https://block385.com/serial-to-ip-devices-hide-thousands-of-old-new-bugs</guid>
<description><![CDATA[ The OT devices that translate machine talk into Internet-speak are riddled with vulnerabilities and more frequently targeted for attacks, researchers say. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt36307cc72d4778e2/69dd36cd61216874471aaef1/Industrial_site-Tony_Watson-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 15:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Serial-to-IP, Devices, Hide, Thousands, Old, &amp;amp, New, Bugs</media:keywords>
</item>

<item>
<title>No Exploit Needed: How Attackers Walk Through the Front Door via Identity&#45;Based Attacks</title>
<link>https://block385.com/no-exploit-needed-how-attackers-walk-through-the-front-door-via-identity-based-attacks</link>
<guid>https://block385.com/no-exploit-needed-how-attackers-walk-through-the-front-door-via-identity-based-attacks</guid>
<description><![CDATA[ The cybersecurity industry has spent the last several years chasing sophisticated threats like zero-days, supply chain compromises, and AI-generated exploits. However, the most reliable entry point for attackers still hasn&#039;t changed: stolen credentials.
Identity-based attacks remain a dominant initial access vector in breaches today. Attackers obtain valid credentials through credential stuffing ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEin_RithPNlLYdgxg906-M63Q0-Kv83Kl-WNjK8x5OjKiSgcDMaljvqb7XkLPoEeUDEMRdi4Cqh9DH-pv9QP1ViNjUi3q3qn5r_Lig04a3zO9TgkgiQqSLC50mE6q-6hr94bo4UnXnP5QksLGeAgSOemxUOZaXIw9Z2UHpZuinm7pqF9N0xtJNVovfojx0/s1600/door.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 14:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Exploit, Needed:, How, Attackers, Walk, Through, the, Front, Door, via, Identity-Based, Attacks</media:keywords>
</item>

<item>
<title>NGate Campaign Targets Brazil, Trojanizes HandyPay to Steal NFC Data and PINs</title>
<link>https://block385.com/ngate-campaign-targets-brazil-trojanizes-handypay-to-steal-nfc-data-and-pins</link>
<guid>https://block385.com/ngate-campaign-targets-brazil-trojanizes-handypay-to-steal-nfc-data-and-pins</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a new iteration of an Android malware family calledNGate that has been found to abuse a legitimate application called HandyPay instead of NFCGate.
&quot;The threat actors took the app, which is used to relay NFC data, and patched it with malicious code that appears to have been AI-generated,&quot; ESET security researcher Lukáš Štefanko said in a report ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjcErEs-NVQwFX9tnOmYqQrfDjLm6WUB5jr8ltsA6bMOlVwmDwzBb5RbYAidS2jxdCPQ9RJtsgl453b7KbY8z_6tOjs0VIA7vF8LjM2OJqkZW8c1IM6TYwToxxp4dk8O0KiozATn5L4U40n2HK-Nya7tcimt1exRy9ZtYnri0XyMuM55W5AbC_8EAE0oDQC/s1600/android-nfc.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 14:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NGate, Campaign, Targets, Brazil, Trojanizes, HandyPay, Steal, NFC, Data, and, PINs</media:keywords>
</item>

<item>
<title>Google Patches Antigravity IDE Flaw Enabling Prompt Injection Code Execution</title>
<link>https://block385.com/google-patches-antigravity-ide-flaw-enabling-prompt-injection-code-execution</link>
<guid>https://block385.com/google-patches-antigravity-ide-flaw-enabling-prompt-injection-code-execution</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a vulnerability in Google&#039;s agentic integrated development environment (IDE), Antigravity, that could be exploited to achieve code execution.
The flaw, since patched, combines Antigravity&#039;s permitted file-creation capabilities with an insufficient input sanitization in Antigravity&#039;s native file-searching tool, find_by_name, to bypass the program&#039;s Strict ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsCaDWCQOL4W8DvgT0eI2Q12HA0ThHQO8TZ-X02vqHH4lZfIeUUZ9yeQAHESn6Oe5AoqLEpTuRL9Gco-SPynh5K0fW8D0KFLEvnHnd48MHKL5OUFnw4lOPsAqBg2N8zlCEnoJMM7ZrtxyVuwhytN3SebEbluda4uN12VG2OVi6fV4SItz_57pdCGe7U0ai/s1600/ide.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 14:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Patches, Antigravity, IDE, Flaw, Enabling, Prompt, Injection, Code, Execution</media:keywords>
</item>

<item>
<title>NGate NFC malware targets Android users through trojanized payment app</title>
<link>https://block385.com/ngate-nfc-malware-targets-android-users-through-trojanized-payment-app</link>
<guid>https://block385.com/ngate-nfc-malware-targets-android-users-through-trojanized-payment-app</guid>
<description><![CDATA[ NFC-based payment fraud is expanding geographically and operationally. A campaign active since November 2025 is targeting Android users in Brazil using a new variant of the NGate malware family, this time embedded in a trojanized version of HandyPay, a legitimate NFC relay application available on Google Play since 2021. ESET Research identified the campaign and attributed two separate NGate samples to the same threat actor. Both samples are distributed from the same domain and use … More →
The post NGate NFC malware targets Android users through trojanized payment app appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/21081703/ngate_nfc-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 13:00:22 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NGate, NFC, malware, targets, Android, users, through, trojanized, payment, app</media:keywords>
</item>

<item>
<title>A single platform powers SIM farm proxy networks across 17 countries</title>
<link>https://block385.com/a-single-platform-powers-sim-farm-proxy-networks-across-17-countries</link>
<guid>https://block385.com/a-single-platform-powers-sim-farm-proxy-networks-across-17-countries</guid>
<description><![CDATA[ Racks of phones and 4G modems, connected to carrier networks and rented out as commercial mobile proxy services, are operating across at least 94 locations in 17 countries. An investigation by infrastructure intelligence firm Infrawatch traced a large portion of those deployments to a shared software platform called ProxySmart, built and operated out of Minsk, Belarus. SIM farm (Source: Infrawatch) Infrawatch identified 87 distinct instances of the ProxySmart control panel exposed on the internet, spread … More →
The post A single platform powers SIM farm proxy networks across 17 countries appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/28163349/malware-danger-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 13:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>single, platform, powers, SIM, farm, proxy, networks, across, countries</media:keywords>
</item>

<item>
<title>CISA Adds 8 Exploited Flaws to KEV, Sets April&#45;May 2026 Federal Deadlines</title>
<link>https://block385.com/cisa-adds-8-exploited-flaws-to-kev-sets-april-may-2026-federal-deadlines</link>
<guid>https://block385.com/cisa-adds-8-exploited-flaws-to-kev-sets-april-may-2026-federal-deadlines</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including three flaws impacting Cisco Catalyst SD-WAN Manager, citing evidence of active exploitation.
The list of vulnerabilities is as follows -

CVE-2023-27351 (CVSS score: 8.2) - An improper authentication vulnerability in PaperCut ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzjZ6Llk3l-F3OFNRpNKvTziH1GObU6niwTMke4hEeI5bVXCcILs3kb25Dehkk1VCBf8NzEEPMLxElgbqLzAq0I1GuFAsDojdbVw-R6CGW6-qMXPaeiKXzQqn9JUL-VoPCVMx8h7FrOXIovnLwLv7T-O2wLdc4kIDA0bftbBDp9kwoDmqq6iYYlaZF6Qaz/s1600/cisa-kev.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 10:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, Adds, Exploited, Flaws, KEV, Sets, April-May, 2026, Federal, Deadlines</media:keywords>
</item>

<item>
<title>Cybersecurity jobs available right now: April 21, 2026</title>
<link>https://block385.com/cybersecurity-jobs-available-right-now-april-21-2026</link>
<guid>https://block385.com/cybersecurity-jobs-available-right-now-april-21-2026</guid>
<description><![CDATA[ Application Security Engineer (DevSecOps / Azure DevOps) BEWAHARVEST | Philippines | Hybrid – View job details As an Application Security Engineer (DevSecOps / Azure DevOps), you will embed security across the SDLC by working with engineering and DevOps teams to implement automated security controls and testing. You will manage application security programs including SAST, DAST, SCA, IAST, and RASP, integrating them into Azure DevOps pipelines with enforceable quality gates. You will perform API security testing, … More →
The post Cybersecurity jobs available right now: April 21, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/11140416/cybersecurity_jobs-1-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 07:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybersecurity, jobs, available, right, now:, April, 21, 2026</media:keywords>
</item>

<item>
<title>Researchers build an encrypted routing layer for private AI inference</title>
<link>https://block385.com/researchers-build-an-encrypted-routing-layer-for-private-ai-inference</link>
<guid>https://block385.com/researchers-build-an-encrypted-routing-layer-for-private-ai-inference</guid>
<description><![CDATA[ Organizations in healthcare, finance, and other sensitive industries want to use large AI models without exposing private data to the cloud servers running those models. A cryptographic technique called Secure Multi-Party Computation (MPC) makes this possible. It splits data into encrypted fragments, distributes them across two or more servers that do not share information with each other, and lets those servers compute an AI result without either one ever seeing the raw input. The catch … More →
The post Researchers build an encrypted routing layer for private AI inference appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/12093307/brain-ai-intelligence-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 07:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researchers, build, encrypted, routing, layer, for, private, inference</media:keywords>
</item>

<item>
<title>Vercel Employee&amp;apos;s AI Tool Access Led to Data Breach</title>
<link>https://block385.com/vercel-employees-ai-tool-access-led-to-data-breach</link>
<guid>https://block385.com/vercel-employees-ai-tool-access-led-to-data-breach</guid>
<description><![CDATA[ Stolen OAuth tokens, which are at the root of these breaches, &quot;are the new attack surface, the new lateral movement,&quot; a researcher noted. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3396b116c4a5d80b/69e6744aa61d112dbb7caf20/allow_access_keyboard_alon_harel_alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 01:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Vercel, Employees, Tool, Access, Led, Data, Breach</media:keywords>
</item>

<item>
<title>Serial&#45;to&#45;IP Devices Hide Thousands of Old and New Bugs</title>
<link>https://block385.com/serial-to-ip-devices-hide-thousands-of-old-and-new-bugs</link>
<guid>https://block385.com/serial-to-ip-devices-hide-thousands-of-old-and-new-bugs</guid>
<description><![CDATA[ The OT devices that translate machine talk into Internet-speak are riddled with vulnerabilities and more frequently targeted for attacks, researchers say. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt36307cc72d4778e2/69dd36cd61216874471aaef1/Industrial_site-Tony_Watson-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 23:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Serial-to-IP, Devices, Hide, Thousands, Old, and, New, Bugs</media:keywords>
</item>

<item>
<title>SGLang CVE&#45;2026&#45;5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files</title>
<link>https://block385.com/sglang-cve-2026-5760-cvss-98-enables-rce-via-malicious-gguf-model-files</link>
<guid>https://block385.com/sglang-cve-2026-5760-cvss-98-enables-rce-via-malicious-gguf-model-files</guid>
<description><![CDATA[ A critical security vulnerability has been disclosed in SGLang that, if successfully exploited, could result in remote code execution on susceptible systems.
The vulnerability, tracked as CVE-2026-5760, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of command injection leading to the execution of arbitrary code.
SGLang is a high-performance, open-source serving ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHmSpfy0MbO4mTB5B4TYrJzfBNO0HD2Z194J1U3YlwUQpQsTGompmNqR7_Rx4nbgPXHs3Mel7tBcZDXOVeYDXev1luKnr5VUzbmPornwB-bcciiA_Zvmam5q9lwPK5b9K-my0_a1VBjA-2Pjmb31yWEiyBAl_ipNM5gvJM19yxcT-Q468-8VL8KrfCYHen/s1600/sgll.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 22:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SGLang, CVE-2026-5760, CVSS, 9.8, Enables, RCE, via, Malicious, GGUF, Model, Files</media:keywords>
</item>

<item>
<title>Product showcase: Syncthing for secure, private file synchronization</title>
<link>https://block385.com/product-showcase-syncthing-for-secure-private-file-synchronization</link>
<guid>https://block385.com/product-showcase-syncthing-for-secure-private-file-synchronization</guid>
<description><![CDATA[ Syncthing is a free and open-source application that synchronizes files directly between your devices. Instead of uploading data to a central server, it uses a peer-to-peer approach, transferring files whenever peers are online. This decentralized model ensures that your data remains private and under your control. Syncthing monitors shared folders for changes. When a file is created, modified, or removed, updates are propagated to connected peers. Synchronization happens automatically once they are online, keeping folder … More →
The post Product showcase: Syncthing for secure, private file synchronization appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16133444/synchthing-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:19 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Product, showcase:, Syncthing, for, secure, private, file, synchronization</media:keywords>
</item>

<item>
<title>How to spot a North Korean fake in a job interview</title>
<link>https://block385.com/how-to-spot-a-north-korean-fake-in-a-job-interview</link>
<guid>https://block385.com/how-to-spot-a-north-korean-fake-in-a-job-interview</guid>
<description><![CDATA[ North Korean operatives are getting hired at companies by passing job interviews using fake identities and AI tools. In this Help Net Security video, Adrian Cheek, a senior cybercrime researcher at Flare, outlines several ways organizations can catch these attempts before extending an offer. Basic video checks, like asking candidates to move their head or place objects in front of the camera, can expose low-quality deepfake setups. Requiring an in-person interview at a later stage … More →
The post How to spot a North Korean fake in a job interview appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16065400/north_korean-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:18 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>How, spot, North, Korean, fake, job, interview</media:keywords>
</item>

<item>
<title>SmokedMeat: Open&#45;source tool shows what attackers do inside CI/CD pipelines</title>
<link>https://block385.com/smokedmeat-open-source-tool-shows-what-attackers-do-inside-cicd-pipelines</link>
<guid>https://block385.com/smokedmeat-open-source-tool-shows-what-attackers-do-inside-cicd-pipelines</guid>
<description><![CDATA[ Boost Security has released SmokedMeat, an open-source framework that runs attack chains against CI/CD infrastructure so engineering and security teams can see what an attacker would do in their specific environment. What the tool does SmokedMeat takes a flagged pipeline vulnerability and executes a live demonstration against a team’s own infrastructure. Starting from a single vulnerability, it deploys a payload, compromises the runner, harvests credentials from process memory, exchanges those credentials for cloud access, exposes … More →
The post SmokedMeat: Open-source tool shows what attackers do inside CI/CD pipelines appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16194738/smokedmeat-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SmokedMeat:, Open-source, tool, shows, what, attackers, inside, CICD, pipelines</media:keywords>
</item>

<item>
<title>EU pushes for stronger cloud sovereignty, awards €180 million to four providers</title>
<link>https://block385.com/eu-pushes-for-stronger-cloud-sovereignty-awards-180-million-to-four-providers</link>
<guid>https://block385.com/eu-pushes-for-stronger-cloud-sovereignty-awards-180-million-to-four-providers</guid>
<description><![CDATA[ The European Commission is stepping up efforts to strengthen the EU’s digital sovereignty by awarding a cloud services tender worth up to €180 million over six years. The initiative gives EU institutions and agencies access to sovereign cloud services delivered by a group of Europe-based providers. Four vendors were selected under the tender. Post Telecom will work with CleverCloud and OVHcloud, while STACKIT and Scaleway secured contracts independently. Proximus joins the list through partnerships with … More →
The post EU pushes for stronger cloud sovereignty, awards €180 million to four providers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/03083348/eu-stars-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:15 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>pushes, for, stronger, cloud, sovereignty, awards, €180, million, four, providers</media:keywords>
</item>

<item>
<title>Meta and PortSwigger drive offensive security further to find what others miss</title>
<link>https://block385.com/meta-and-portswigger-drive-offensive-security-further-to-find-what-others-miss</link>
<guid>https://block385.com/meta-and-portswigger-drive-offensive-security-further-to-find-what-others-miss</guid>
<description><![CDATA[ Meta Bug Bounty and PortSwigger have formed a partnership to help security researchers sharpen their skills, collaborate more closely, and improve vulnerability discovery. The initiative combines Meta’s bug bounty program with PortSwigger’s Burp Suite, reflecting a shared focus on improving both tooling and education for the global security community. “By joining forces, we’re not just offering resources; we’re building bridges between communities,” Meta Bug Bounty said. In this collaboration, PortSwigger is providing Burp Suite Professional … More →
The post Meta and PortSwigger drive offensive security further to find what others miss appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/09135147/meta-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:14 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Meta, and, PortSwigger, drive, offensive, security, further, find, what, others, miss</media:keywords>
</item>

<item>
<title>AI platform ATHR makes voice phishing a one&#45;person job</title>
<link>https://block385.com/ai-platform-athr-makes-voice-phishing-a-one-person-job</link>
<guid>https://block385.com/ai-platform-athr-makes-voice-phishing-a-one-person-job</guid>
<description><![CDATA[ For $4,000 and a cut of the take, a lone criminal can now run a fully automated voice-phishing operation via ATHR, a plaform that spoofs emails alerts from Google, Microsoft, and Coinbase, buries a phone number in each message, and when the victim calls back, hands them off to either a human scammer or an AI voice agent. ATHR for sale AI is becoming part of everyday criminal workflows, and fueling the rise in cyber … More →
The post AI platform ATHR makes voice phishing a one-person job appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/20113549/robocaller-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>platform, ATHR, makes, voice, phishing, one-person, job</media:keywords>
</item>

<item>
<title>Vercel breached via compromised third&#45;party AI tool</title>
<link>https://block385.com/vercel-breached-via-compromised-third-party-ai-tool</link>
<guid>https://block385.com/vercel-breached-via-compromised-third-party-ai-tool</guid>
<description><![CDATA[ Cloud deployment and hosting platform Vercel has suffered a security breach that resulted in attackers accessing some of its internal systems and compromising Vercel credentials of a “limited subset of customers”. Advice for affected customers “The incident originated with a compromise of Context.ai, a third-party AI tool used by a Vercel employee,” the Vercel security team explained in a post published on Sunday. “The attacker used that access to take over the employee’s Vercel Google … More →
The post Vercel breached via compromised third-party AI tool appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/20165413/vercel-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Vercel, breached, via, compromised, third-party, tool</media:keywords>
</item>

<item>
<title>WhatsApp Leaks User Metadata to Attackers</title>
<link>https://block385.com/whatsapp-leaks-user-metadata-to-attackers</link>
<guid>https://block385.com/whatsapp-leaks-user-metadata-to-attackers</guid>
<description><![CDATA[ Strangers can infer limited info about you without knowing or messaging you, which could theoretically aid certain kinds of malicious activity. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd2f4132144e85dfb/69e291d49ba34f4b11a4782a/WhatsApp-stLegat-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>WhatsApp, Leaks, User, Metadata, Attackers</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge &amp;amp; More</title>
<link>https://block385.com/weekly-recap-vercel-hack-push-fraud-qemu-abused-new-android-rats-emerge-more</link>
<guid>https://block385.com/weekly-recap-vercel-hack-push-fraud-qemu-abused-new-android-rats-emerge-more</guid>
<description><![CDATA[ Monday’s recap shows the same pattern in different places. A third-party tool becomes a way in, then leads to internal access. A trusted download path is briefly swapped to deliver malware. Browser extensions act normally while pulling data and running code. Even update channels are used to push payloads. It’s not breaking systems—it’s bending trust.
There’s also a shift in how attacks run. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirkQSoHlNZvcdjrevc7r-D8mPj49i3XRimQjk-HtEVDYVX4vKEcW4JLiTblV5oI8MtUib2Q5iFerdt0x4_mGDvMJqsDd2wX6QNQxM25Wnrq-MRYADw1YuJly5yoSTIz_ToqlWsAKA2hLwru4Crx8aSguTETpDl4mjRfrCg0G8Cca5Rk0Am6FCwRCNPIqBy/s1600/recap-april.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 16:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>⚡, Weekly, Recap:, Vercel, Hack, Push, Fraud, QEMU, Abused, New, Android, RATs, Emerge, More</media:keywords>
</item>

<item>
<title>Coast Guard&amp;apos;s New Cybersecurity Rules Offer Lessons for CISOs</title>
<link>https://block385.com/coast-guards-new-cybersecurity-rules-offer-lessons-for-cisos</link>
<guid>https://block385.com/coast-guards-new-cybersecurity-rules-offer-lessons-for-cisos</guid>
<description><![CDATA[ The Maritime Transportation Security Act (MTSA) requires plans to protect OT systems, audits by independent third parties, and a hybrid OT-security role. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6abfeadd95d5d9a7/69e150afd52b1acba510683c/maritime-shipping-GreenOak-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 15:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Coast, Guards, New, Cybersecurity, Rules, Offer, Lessons, for, CISOs</media:keywords>
</item>

<item>
<title>Why Most AI Deployments Stall After the Demo</title>
<link>https://block385.com/why-most-ai-deployments-stall-after-the-demo</link>
<guid>https://block385.com/why-most-ai-deployments-stall-after-the-demo</guid>
<description><![CDATA[ The fastest way to fall in love with an AI tool is to watch the demo.
Everything moves quickly. Prompts land cleanly. The system produces impressive outputs in seconds. It feels like the beginning of a new era for your team.
But most AI initiatives don&#039;t fail because of bad technology. They stall because what worked in the demo doesn&#039;t survive contact with real operations. The gap between a ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihbqFqPAZp1E63toW329kiZdn6SI22yIZDqIGwAsO9Q2_Xi8g6qCWwj0dH2A4LupHGVzobsdiP9dcvAoSzXSKkte4q0yLnAN2V5wsntPma9PIiv4SzNQnU3wkFCztV-N8Dn36S_oP9tq3obvAVOUUPegjGguA1SUVYR2ptZigH9ET-5dTVZU966eoLh9A/s1600/tines.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 14:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, Most, Deployments, Stall, After, the, Demo</media:keywords>
</item>

<item>
<title>Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain</title>
<link>https://block385.com/anthropic-mcp-design-vulnerability-enables-rce-threatening-ai-supply-chain</link>
<guid>https://block385.com/anthropic-mcp-design-vulnerability-enables-rce-threatening-ai-supply-chain</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a critical &quot;by design&quot; weakness in the Model Context Protocol&#039;s (MCP) architecture that could pave the way for remote code execution and have a cascading effect on the artificial intelligence (AI) supply chain.
&quot;This flaw enables Arbitrary Command Execution (RCE) on any system running a vulnerable MCP implementation, granting attackers direct access to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbUnokdbuoiv9j36ekgZbT7VQVSUJBbB4xzoXJKD8iTTO76tSRyhXGdOk2aZKX-RU_WeGyRzHfAf0zwva_cSY7JL5a7Fhmrtzjd-p-kg6JK75nE-nQiSESaDAHlyTN8be1iUFxp9xCq94-1JwZ16pwYZJkKxIFwqa8vNmfxZl8OCXRWnT0GKWOpYVPgbMb/s1600/mcp.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 14:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Anthropic, MCP, Design, Vulnerability, Enables, RCE, Threatening, Supply, Chain</media:keywords>
</item>

<item>
<title>Researchers Detect ZionSiphon Malware Targeting Israeli Water, Desalination OT Systems</title>
<link>https://block385.com/researchers-detect-zionsiphon-malware-targeting-israeli-water-desalination-ot-systems</link>
<guid>https://block385.com/researchers-detect-zionsiphon-malware-targeting-israeli-water-desalination-ot-systems</guid>
<description><![CDATA[ Cybersecurity researchers have flagged a new malware called ZionSiphon that appears to be specifically designed to target Israeli water treatment and desalination systems.
The malware has been codenamed ZionSiphon by Darktrace, highlighting its ability to set up persistence, tamper with local configuration files, and scan for operational technology (OT)-relevant services on the local subnet. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihoHF4qP6hw3msdH8s3stwjZR1a2Aqp6kSB97wFpmQefaNtVM8lc-Eu0Gv3jeMK2qa9aLGjSSZp3cJGNaE3eft6h17HnKqPGlhLbfkVzLqfv3VW-SEDLToW6z8SGiDeSE8jXdHyNqxqG_a4B34PjM3rbiOddEvQlgOFfbow8n6V_qGB-70uEj9fRrNLVOt/s1600/water.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researchers, Detect, ZionSiphon, Malware, Targeting, Israeli, Water, Desalination, Systems</media:keywords>
</item>

<item>
<title>Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials</title>
<link>https://block385.com/vercel-breach-tied-to-context-ai-hack-exposes-limited-customer-credentials</link>
<guid>https://block385.com/vercel-breach-tied-to-context-ai-hack-exposes-limited-customer-credentials</guid>
<description><![CDATA[ Web infrastructure provider Vercel has disclosed a security breach that allows bad actors to gain unauthorized access to &quot;certain&quot; internal Vercel systems.
The incident stemmed from the compromise of Context.ai, a third-party artificial intelligence (AI) tool, that was used by an employee at the company.
&quot;The attacker used that access to take over the employee&#039;s Vercel Google Workspace account, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjcLAcekric_be3bGt2lBu4NxiCcd3FZap2VzD0r9Z8zGegVjwixsexsGVGVmwvLwpaercKHyq9BFA7WV2a_DApLP7qpjg17hE8bu63FHsBoW1wFV0BJmATkuKIM1YU2bf8v9gRPM_tyw8RNINMSXiwzM5jbxjamO8HYm-VsVxgB0lbyRKr4kNuzzRY-JXq/s1600/breach.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 08:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Vercel, Breach, Tied, Context, Hack, Exposes, Limited, Customer, Credentials</media:keywords>
</item>

<item>
<title>Week in review: Acrobat Reader flaw exploited, Claude Mythos offensive capabilities and limits</title>
<link>https://block385.com/week-in-review-acrobat-reader-flaw-exploited-claude-mythos-offensive-capabilities-and-limits</link>
<guid>https://block385.com/week-in-review-acrobat-reader-flaw-exploited-claude-mythos-offensive-capabilities-and-limits</guid>
<description><![CDATA[ Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Bringing governance and visibility to machine and AI identities In this Help Net Security interview, Archit Lohokare, CEO of AppViewX, explains how the rise of AI marked a turning point where machine and AI agent identities began converging into a single problem. Drawing on his experience across IBM and CyberArk, he describes the shift from human-driven systems to autonomous machines. … More →
The post Week in review: Acrobat Reader flaw exploited, Claude Mythos offensive capabilities and limits appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/12/01112506/cybersecurity_week_in_review2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 19 Apr 2026 11:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Week, review:, Acrobat, Reader, flaw, exploited, Claude, Mythos, offensive, capabilities, and, limits</media:keywords>
</item>

<item>
<title>[Webinar] Eliminate Ghost Identities Before They Expose Your Enterprise Data</title>
<link>https://block385.com/webinar-eliminate-ghost-identities-before-they-expose-your-enterprise-data</link>
<guid>https://block385.com/webinar-eliminate-ghost-identities-before-they-expose-your-enterprise-data</guid>
<description><![CDATA[ In 2024, compromised service accounts and forgotten API keys were behind 68% of cloud breaches. Not phishing. Not weak passwords. Unmanaged non-human identities that nobody was watching.
For every employee in your org, there are 40 to 50 automated credentials: service accounts, API tokens, AI agent connections, and OAuth grants. When projects end or employees leave, most ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6vJpO9kksCQDpSksNkqDFNUCbXD70dMGYqI6P9S_XPMY5d8BR8PVdrsVQP1ZJO_-nzL6eQShM3Cap9heQ5kAglsPjfxwIcXPSsf_cfgUVnGQ2XzIWVOuo7JhxMjnHYDN6r9KlQ6LqZJisRZkjatnWChuzUkSlXRa1hFseUPq28PZ5gjGR7L2WzTFdZ3fM/s1600/ghost.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 18 Apr 2026 12:30:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Webinar, Eliminate, Ghost, Identities, Before, They, Expose, Your, Enterprise, Data</media:keywords>
</item>

<item>
<title>$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims</title>
<link>https://block385.com/1374m-hack-shuts-down-sanctioned-grinex-exchange-after-intelligence-claims</link>
<guid>https://block385.com/1374m-hack-shuts-down-sanctioned-grinex-exchange-after-intelligence-claims</guid>
<description><![CDATA[ Grinex, a Kyrgyzstan-incorporated cryptocurrency exchange sanctioned by the U.K. and the U.S. last year, said it&#039;s suspending operations after it blamed Western intelligence agencies for a $13.74 million hack.
The exchange said it fell victim to what it described as a large-scale cyber attack that bore hallmarks of foreign intelligence agency involvement. This attack led to the theft of over 1 ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPcUvJCFRqDmEr1ZDSaUJCAymmKwZOeXdmfPY6Eekp7tLOpqjXLKHilHOHlNyuxmennQE8H5oxuRTaCncC8hsoGYEloD8OrDlR1wpbxGivBBB7KdVX8kiv_pOzC6GQ7LNPKoJGkFklpW0XutuLRPjl3I5cPta1n-BqVyAdO1luW3EUR8jyiZEtVjVTGWUK/s1600/grinex.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 18 Apr 2026 12:30:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>13.74M, Hack, Shuts, Down, Sanctioned, Grinex, Exchange, After, Intelligence, Claims</media:keywords>
</item>

<item>
<title>Mirai Variant Nexcorium Exploits CVE&#45;2024&#45;3721 to Hijack TBK DVRs for DDoS Botnet</title>
<link>https://block385.com/mirai-variant-nexcorium-exploits-cve-2024-3721-to-hijack-tbk-dvrs-for-ddos-botnet</link>
<guid>https://block385.com/mirai-variant-nexcorium-exploits-cve-2024-3721-to-hijack-tbk-dvrs-for-ddos-botnet</guid>
<description><![CDATA[ Threat actors are exploiting security flaws in TBK DVR and end‑of‑life (EoL) TP-Link Wi-Fi routers to deploy Mirai-botnet variants on compromised devices, according to findings from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42.
The attack targeting TBK DVR devices has been found to exploit CVE-2024-3721 (CVSS score: 6.3), a medium-severity command injection vulnerability affecting ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6cxZZMfiWctk3Me9QO6UlzVRFab0SPGMTzThjpcPHCXm49bQ0rRvtG2W6gicJw4Mi1QUuv-yTDMK5GKJju3QicyjYJwdbA86Ok8w2oU5Vg28l4s0HAVv7_c03dStaM7OPd4Yq0khmm9MeQVUYnCYThMx4JvkCnZZ5PEtCXAA90vKfsAumsMAIw085JIsz/s1600/botnet-ddos.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 18 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mirai, Variant, Nexcorium, Exploits, CVE-2024-3721, Hijack, TBK, DVRs, for, DDoS, Botnet</media:keywords>
</item>

<item>
<title>Codex can now operate between apps. Where are the boundaries?</title>
<link>https://block385.com/codex-can-now-operate-between-apps-where-are-the-boundaries</link>
<guid>https://block385.com/codex-can-now-operate-between-apps-where-are-the-boundaries</guid>
<description><![CDATA[ OpenAI is rolling out a major update to the Codex desktop app for users signed in with ChatGPT. Personalization features, including context-aware suggestions and memory, will roll out to Enterprise, Edu, and users in the EU and UK soon. Computer use is initially available on macOS and will expand to EU and UK users in the near future. Screenshot of Codex computer use on Mac (Source: OpenAI) The update expands Codex into a more capable … More →
The post Codex can now operate between apps. Where are the boundaries? appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/05155719/openai-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 23:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Codex, can, now, operate, between, apps., Where, are, the, boundaries</media:keywords>
</item>

<item>
<title>How NIST&amp;apos;s Cutback of CVE Handling Impacts Cyber Teams</title>
<link>https://block385.com/how-nists-cutback-of-cve-handling-impacts-cyber-teams</link>
<guid>https://block385.com/how-nists-cutback-of-cve-handling-impacts-cyber-teams</guid>
<description><![CDATA[ Industry and ad hoc coalitions appear poised to help fill the gap created by NIST&#039;s decision to cut back on CVE data enrichment. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf63750cb2e1d5266/69e26d60df4579bd291869e2/NIST_HQ_Grandbrothers_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>How, NISTs, Cutback, CVE, Handling, Impacts, Cyber, Teams</media:keywords>
</item>

<item>
<title>Tycoon 2FA Phishers Scatter, Adopt Device Code Phishing</title>
<link>https://block385.com/tycoon-2fa-phishers-scatter-adopt-device-code-phishing</link>
<guid>https://block385.com/tycoon-2fa-phishers-scatter-adopt-device-code-phishing</guid>
<description><![CDATA[ In embracing device code phishing, attackers trick victims into handing over account access by using a service&#039;s legitimate new-device login flow. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt70085bc1304b3cb3/69e2855c41f7f85ddb368bc3/QR_code-Harry_Wedzinga-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tycoon, 2FA, Phishers, Scatter, Adopt, Device, Code, Phishing</media:keywords>
</item>

<item>
<title>Every Old Vulnerability Is Now an AI Vulnerability</title>
<link>https://block385.com/every-old-vulnerability-is-now-an-ai-vulnerability</link>
<guid>https://block385.com/every-old-vulnerability-is-now-an-ai-vulnerability</guid>
<description><![CDATA[ AI&#039;s danger isn&#039;t that it&#039;s creating new bugs, it&#039;s that it&#039;s amplifying old ones. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc29c0d49db0e3dc1/69e15cd7061435b0d4675403/cute_robot_power_off_button.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 19:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Every, Old, Vulnerability, Now, Vulnerability</media:keywords>
</item>

<item>
<title>Three Microsoft Defender Zero&#45;Days Actively Exploited; Two Still Unpatched</title>
<link>https://block385.com/three-microsoft-defender-zero-days-actively-exploited-two-still-unpatched</link>
<guid>https://block385.com/three-microsoft-defender-zero-days-actively-exploited-two-still-unpatched</guid>
<description><![CDATA[ Huntress is warning that threat actors are exploiting three recently disclosed security flaws in Microsoft Defender to gain elevated privileges in compromised systems.
The activity involves the exploitation of three vulnerabilities that are codenamed BlueHammer (requires GitHub sign-in), RedSun, and UnDefend, all of which were released as zero-days by a researcher known as Chaotic Eclipse ( ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJ8x3Yg0CYomOu1IpHfhfmiqJtgaMSnnoE2tJR6RdXGIy1rLRTORge-ukCLYkEj6xzeGTvmuy-68qfU4me_nG7pvwZi21h7ycQFwY3OXCH1_p_g35BAYeaHdz3uRKJD2mQCjUIcxha2WzMePpup2VHarxZVxy3QNtaRAjET-2FK7GemiuvyI8MpNPFVyEQ/s1600/defender.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 16:30:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Three, Microsoft, Defender, Zero-Days, Actively, Exploited, Two, Still, Unpatched</media:keywords>
</item>

<item>
<title>Mozilla challenges enterprise AI providers with Thunderbolt, open&#45;source AI client under your control</title>
<link>https://block385.com/mozilla-challenges-enterprise-ai-providers-with-thunderbolt-open-source-ai-client-under-your-control</link>
<guid>https://block385.com/mozilla-challenges-enterprise-ai-providers-with-thunderbolt-open-source-ai-client-under-your-control</guid>
<description><![CDATA[ For organizations that want to keep company data within their own systems and have more control over how AI is deployed, Mozilla is offering an alternative to externally hosted AI services with Thunderbolt, an open-source AI client designed for self-hosted use. Thunderbolt is available through a waitlist, with native applications for web, macOS, Windows, Linux, iOS, and Android. Its source code is published on GitHub. Mozilla says Thunderbolt “gives organizations what proprietary AI services can’t,” … More →
The post Mozilla challenges enterprise AI providers with Thunderbolt, open-source AI client under your control appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16201730/mozilla_thunderbolt-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 15:00:50 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mozilla, challenges, enterprise, providers, with, Thunderbolt, open-source, client, under, your, control</media:keywords>
</item>

<item>
<title>Liongard upgrades LiongardIQ with AI access, live asset data, and deeper discovery</title>
<link>https://block385.com/liongard-upgrades-liongardiq-with-ai-access-live-asset-data-and-deeper-discovery</link>
<guid>https://block385.com/liongard-upgrades-liongardiq-with-ai-access-live-asset-data-and-deeper-discovery</guid>
<description><![CDATA[ Liongard has announced the expansion of LiongardIQ with new capabilities spanning programmatic AI integration, conversational querying, enhanced network discovery, and deeper identity mapping, extending its system of authority for asset intelligence across the full IT stack. Without a trusted foundation of asset intelligence, automation runs on assumptions, AI agents query stale data, and security gaps go undetected. LiongardIQ is that foundation, continuously discovering and monitoring every asset, identity, and configuration across the IT stack. “The … More →
The post Liongard upgrades LiongardIQ with AI access, live asset data, and deeper discovery appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 15:00:46 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Liongard, upgrades, LiongardIQ, with, access, live, asset, data, and, deeper, discovery</media:keywords>
</item>

<item>
<title>GitLab 18.11 brings agentic AI to security fixes, CI pipelines, and delivery analytics</title>
<link>https://block385.com/gitlab-1811-brings-agentic-ai-to-security-fixes-ci-pipelines-and-delivery-analytics</link>
<guid>https://block385.com/gitlab-1811-brings-agentic-ai-to-security-fixes-ci-pipelines-and-delivery-analytics</guid>
<description><![CDATA[ GitLab has released GitLab 18.11, expanding agentic AI across the entire software lifecycle with security remediation, pipeline configuration, and delivery analytics. AI-generated code moves faster than the systems around it can keep up with, creating the AI paradox: faster code generation without faster delivery, security, or operations to match. As code volume grows, so does the backlog of pipelines to configure, security findings to remediate, and delivery questions to answer. GitLab 18.11 helps address those … More →
The post GitLab 18.11 brings agentic AI to security fixes, CI pipelines, and delivery analytics appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 15:00:38 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GitLab, 18.11, brings, agentic, security, fixes, pipelines, and, delivery, analytics</media:keywords>
</item>

<item>
<title>Researcher drops two more Microsoft Defender zero&#45;days, all three now exploited in the wild</title>
<link>https://block385.com/researcher-drops-two-more-microsoft-defender-zero-days-all-three-now-exploited-in-the-wild</link>
<guid>https://block385.com/researcher-drops-two-more-microsoft-defender-zero-days-all-three-now-exploited-in-the-wild</guid>
<description><![CDATA[ The security researcher who earlier this month published a proof-of-concept (PoC) exploit for a zero-day privilege escalation vulnerability in Microsoft Defender is back with two more. The first, dubbed “RedSun,” is another privilege escalation flaw in the same platform. The second, “UnDefend,” allows a standard user to block Microsoft Defender from receiving signature updates or disable it entirely (if Microsoft pushes a major Defender update). And, according to Huntress researchers, all three exploitation techniques have … More →
The post Researcher drops two more Microsoft Defender zero-days, all three now exploited in the wild appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/03115429/microsoft-windows-defender-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 15:00:25 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researcher, drops, two, more, Microsoft, Defender, zero-days, all, three, now, exploited, the, wild</media:keywords>
</item>

<item>
<title>Google wipes out 602 million scam ads with Gemini on duty</title>
<link>https://block385.com/google-wipes-out-602-million-scam-ads-with-gemini-on-duty</link>
<guid>https://block385.com/google-wipes-out-602-million-scam-ads-with-gemini-on-duty</guid>
<description><![CDATA[ Google claims that its security teams work around the clock using its Gemini AI models to detect and stop harmful ads. “Bad actors are using generative AI to create deceptive ads at scale, and Gemini helps us detect and block them in real time” Keerat Sharma, VP and GM, Ads Privacy and Safety, Google, said. “Our models analyze hundreds of billions of signals — including account age, behavioral cues and campaign patterns — to stop … More →
The post Google wipes out 602 million scam ads with Gemini on duty appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/12/07063943/google_gemini.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 15:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, wipes, out, 602, million, scam, ads, with, Gemini, duty</media:keywords>
</item>

<item>
<title>Coast Guard&amp;apos;s New Cybersecurity Rules Offers Lessons for CISOs</title>
<link>https://block385.com/coast-guards-new-cybersecurity-rules-offers-lessons-for-cisos</link>
<guid>https://block385.com/coast-guards-new-cybersecurity-rules-offers-lessons-for-cisos</guid>
<description><![CDATA[ The Maritime Transportation Security Act (MTSA) requires plans to protect OT systems, audits by independent third parties, and a hybrid OT-security role. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6abfeadd95d5d9a7/69e150afd52b1acba510683c/maritime-shipping-GreenOak-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 15:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Coast, Guards, New, Cybersecurity, Rules, Offers, Lessons, for, CISOs</media:keywords>
</item>

<item>
<title>NIST Revamps CVE Framework to Focus on High&#45;Impact Vulnerabilities</title>
<link>https://block385.com/nist-revamps-cve-framework-to-focus-on-high-impact-vulnerabilities</link>
<guid>https://block385.com/nist-revamps-cve-framework-to-focus-on-high-impact-vulnerabilities</guid>
<description><![CDATA[ The National Institute of Standards and Technology carved a new path for vulnerability remediation by changing the way it prioritizes software flaws. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blta5e672c25e2a318e/689359079136f61896630252/vulnerability-ktdesign-AdobeStock.jpeg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 15:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NIST, Revamps, CVE, Framework, Focus, High-Impact, Vulnerabilities</media:keywords>
</item>

</channel>
</rss>