News Archive
582 stories · page 24 of 25Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
Lawmakers Demand Answers as CISA Tries to Contain Data Leak
Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a v
Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada
Canadian authorities on Wednesday arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf, a fast spreading Internet-of-Things botnet that enslaved millions of devices for use in a series of massive distributed deni
Microsoft’s MSHTA Legacy Tool Still Powers Malware Campaigns on Windows
Security researchers have found that attackers are still leveraging Microsoft's MSHTA utility to run malware campaigns on Windows systems. This legacy tool, which is present on most Windows installations, can execute scripts from various sources, making it a persistent threat.
CISA Admin Leaked AWS GovCloud Keys on Github
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of inte
Weekly Update 504
It's a hot topic, the old "pay or don't pay" for hackers not to leak your data. Since recording this a few days ago, we've had Grafana go with the "no pay" approach, and I've seen a raft
Cyber Breach Impact on Stock Prices Explored
Researchers investigated whether public indicators of cyber breaches can predict market reactions and inform trading strategies. They analyzed data from company filings, blogs, and social media to test a hypothesis suggesting shorting stocks after a breach becomes visible and then going long as the market recovers. The study found mixed results, questioning common assumptions about how the market values cyber failures.
Welcoming the Bahamian Government to Have I Been Pwned
Today, we welcome the 44th government onboarded to Have I Been Pwned’s free gov service: The Bahamas. The National Computer Incident Response Team of The Bahamas, CIRT-BS, now has access to monitor government domains against the data in HIB
A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens
We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible to go from a zero-click context to root on Android in just two exploits. The Dolby 0-click vulnerability existed across all of Android, until it
Welcoming the Bangladesh Government to Have I Been Pwned
Today, we welcome the 43rd government onboarded to Have I Been Pwned's free gov service, Bangladesh. The BGD e-GOV CIRT department now has full access to query all their government domains via API, and monitor them against future breaches.
EtherRat and TukTuk Malware Campaigns Lead to The Gentleman Ransomware
The EtherRat malware, initially identified in late 2025 targeting Linux servers via a React2Shell vulnerability, has evolved. A Windows variant emerged in early 2026, with investigations revealing earlier activity. These campaigns, alongside the TukTuk C2, have now been linked to the deployment of The Gentleman ransomware.
Welcoming the Costa Rican Government to Have I Been Pwned
Today, we welcome the 42nd government onboarded to Have I Been Pwned’s free gov service: Costa Rica. The CSIRT of the Government of Costa Rica now has access to monitor government domains against the data in HIBP. This enables their nationa
Weekly Update 503
Well, it's the day before the Instructure "pay or leak" deadline (at least by my Aussie watch), and the company remains removed from the ShinyHunters website. In its place sits a press statement that amounts to "we're not making any stateme
Cloud Worm PCPJack Steals Credentials and Evicts TeamPCP Artifacts
A new credential theft framework dubbed PCPJack has been identified, capable of spreading across exposed cloud infrastructure. The tool not only harvests sensitive data from various cloud services but also actively removes artifacts associated with the threat actor group TeamPCP. PCPJack targets services like Docker, Kubernetes, and MongoDB, exfiltrating stolen information and seeking to infect additional systems.
Operation Road Trap: Fake toll and parking texts are spreading worldwide
Scammers are actively conducting a global smishing campaign, sending fake text messages that impersonate toll and parking authorities. These messages aim to trick drivers into clicking malicious links or providing sensitive information. The campaign has been ongoing since late 2025 and has already distributed tens of thousands of fraudulent texts across multiple countries.
AI threats in the wild: The current state of prompt injections on the web
Google's Threat Intelligence teams have analyzed the prevalence of indirect prompt injection (IPI) attacks on the public web. Their research indicates that while sophisticated IPI attacks are not yet widespread, there is a growing trend of experimentation by threat actors. The observed attacks range from harmless pranks and SEO manipulation to more concerning attempts at data exfiltration and system destruction, though current implementations are often simplistic.
Bringing Rust to the Pixel Baseband
Google is enhancing the security of its Pixel devices by integrating a memory-safe Rust-based DNS parser into the cellular modem firmware. This move aims to mitigate memory-safety vulnerabilities, a significant risk in the complex and remotely attackable modem code. The company hopes this initiative will encourage the wider adoption of memory-safe languages in low-level system programming.
Protecting Cookies with Device Bound Session Credentials
Google's Chrome browser is rolling out Device Bound Session Credentials (DBSC) to Windows users, with macOS support coming soon. This new feature aims to prevent session theft by cryptographically linking user sessions to a specific device. Previously, stolen session cookies could grant attackers access to accounts without needing passwords, but DBSC makes these exfiltrated cookies unusable, shifting defenses from reactive detection to proactive prevention.
Google Workspace’s continuous approach to mitigating indirect prompt injections
Google is detailing its ongoing efforts to combat indirect prompt injection attacks against its Workspace AI features, like Gemini. This type of attack manipulates AI behavior by inserting malicious instructions into the data or tools the AI uses, potentially without direct user interaction. Google employs a continuous improvement strategy, utilizing both human and automated red-teaming exercises to discover and defend against emerging threats.
VRP 2025 Year in Review
Google's Vulnerability Rewards Program (VRP) celebrated its 15th anniversary in 2025, awarding a record $17 million to over 700 researchers globally. The program saw significant growth, including the launch of a dedicated AI VRP and expanded reward categories for AI features within the Chrome VRP. Additionally, a new patch rewards program was introduced for the OSV-SCALIBR tool.
Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android
Google is preparing Android for the advent of quantum computing by integrating post-quantum cryptography (PQC) standards into its operating system. This proactive, multi-year migration aims to protect sensitive data and transactions from being compromised by future quantum computers. The PQC enhancements will be tested starting with the Android 17 beta release and will be available in the production version, establishing a quantum-resistant chain of trust across the platform.
Windsurf IDE Extension Drops Malware via Solana Blockchain
Researchers have identified a malicious extension for the Windsurf IDE that utilizes the Solana blockchain to distribute a multi-stage malware. This stealer is designed to exfiltrate sensitive information.
On the Effectiveness of Mutational Grammar Fuzzing
Mutational grammar fuzzing is a fuzzing technique in which the fuzzer uses a predefined grammar that describes the structure of the samples. When a sample gets mutated, the mutations happen in such a way that any resulting samples still adh
A Deep Dive into the GetProcessHandleFromHwnd API
In my previous blog post I mentioned the GetProcessHandleFromHwnd API. This was an API I didn’t know existed until I found a publicly disclosed UAC bypass using the Quick Assist UI Access application. This API looked interesting so I though
Bypassing Administrator Protection by Abusing UI Access
In my last blog post I introduced the new Windows feature, Administrator Protection and how it aimed to create a secure boundary for UAC where one didn’t exist. I described one of the ways I was able to bypass the feature before it was rele