Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Security. Show all posts
Malicious Code
Apache Apache Server Attack Apache Vulnerability Critical security flaw Cyber Security HTTP HTTP Attacks Malicious Code

Apache HTTP/2 Security Flaw Exposes Servers to Critical Remote Code Execution Attacks

 

A new vulnerability in Apache HTTP Server could allow an attacker to run malicious code remotely on vulnerable systems. The vulnerability, tracked as CVE-2026-119618, affects the HTTP/2 module (mod_http2) and has a CVSS score of 9.8 which means it is critical. This has been fixed in Apache version 2.4.71 which was released on the 11th November 2026. 

The Apache versions affected are between 2.4.55 and 2.4.70. However, only systems where HTTP/2 has been enabled are vulnerable. Red Hat state "An attacker with network access to a vulnerable system could exploit this vulnerability to take control of the server process." As no authentication is required systems that are network accessible could be at high risk. Red Hat’s analysis of the vulnerability states that there is public research showing a reliable exploit for a server running the default configuration and mod_http2 enabled. The research was not detailed or sourced. 

However, cybersecurity firm Wiz state that there is no exploit available and no attacks have been observed in the wild. HTTP/2 is not enabled by default. It can be enabled globally for all virtual hosts or just on specific virtual hosts. This is done by adding ‘h2’ to the Protocols directive for secure HTTP/2 (TLS) or ‘h2c’ for insecure HTTP/2 (TCP). All configuration files should be reviewed by the security team. Apache recommend upgrading to version 2.4.71. This also includes a fix for a crash issue in mod_md (Important) and a memory overwrite vulnerability in mod_vhost_alias (Low severity). If you are using official builds of Apache then administrators should upgrade to the latest version. This also affects standalone versions of the HTTP/2 module (mod_h2). 

These versions affected are between 2.0.8 to 2.0.42. There is no fixed version available. The GitHub repository has been archived and the latest version published is 2.0.42. The patch is available for some OSs. Red Hat have patched Enterprise Linux versions 9 and 10. However, this vulnerability is rated as Important. This is because the HTTP/2 streams use separate memory allocators making it harder to exploit. Enterprise Linux 8 and below are unaffected. Debian have patched this in their unstable version. Bookworm, trixie and forky are still affected. 
Amazon Linux 2, 2023 and 2027 Preview are waiting on patches. Ubuntu do not have a specific vulnerability page.  
If you cannot patch your systems then Wiz recommend disabling HTTP/2 by removing ‘h2’ and ‘h2c’ from the Protocols directive. This will leave you with HTTP/1.1. This vulnerability was first reported by Anthropic’s OSS Scanner on the 26th October. The scanner uses Anthropic’s AI models to scan open source software. It was also reported by Anthony Weems and Simon Scannell from Google Cloud Vulnerability Research last week. This comes after another vulnerability in Apache’s HTTP/2 module (CVE-2026-23918) was patched in version 2.4.67 in May. Upgrading to this version or any version after up to 2.4.70 won’t protect your systems from this new vulnerability.
Read more »
Red Hat
Critical Flaw Cyber Security Hacking Private Container Images Red Hat

Critical Red Hat Quay Flaw Could Allow Attackers to Steal Private Container Images


A critical security vulnerability in Red Hat Quay, an enterprise container registry platform, could allow attackers to access private container images, modify repository contents and maintain persistent access to affected systems. 

Tracked as CVE-2026-123710, the flaw carries a CVSS severity score of 9.8 out of 10, placing it in the critical category. According to Red Hat, the vulnerability affects deployments in which the service responsible for managing signing keys is accessible to untrusted clients.

The vulnerability exists in Quay's service key server, which manages the cryptographic keys used to sign registry access tokens. These tokens determine whether users and applications can download or upload container images.

According to Red Hat's security advisory, an unauthenticated attacker can exploit weaknesses in the key rotation mechanism to install an unauthorized signing key that the registry automatically trusts. When anonymous access is enabled, an attacker can obtain a registry token and use it to manipulate the key rotation process.

Once the malicious key has been installed, attackers can generate their own registry tokens with read and write permissions across repositories. This allows them to access private container images belonging to other users or organizations without following the platform's normal access restrictions.

According to Red Hat's Bugzilla report, "rotation also deletes the legitimate instance key as a side effect, and the attacker key can delete replacement instance keys."

Beyond stealing images, attackers could also replace or overwrite repository contents. Such modifications could affect software development and deployment processes, particularly when automated systems download compromised images from the registry. Sensitive credentials and other secrets stored within container images could also be exposed.

Another scaring aspect of the vulnerability is the persistence of unauthorized access. The malicious signing key can be configured without an expiration date and remains active even after the registry is restarted. Red Hat also warned that attackers could use the compromised key to delete legitimate signing keys, potentially disrupting normal image uploads and downloads.

Disabling anonymous access does not completely eliminate the risk, as users with valid Quay accounts can also exploit the vulnerability. Similarly, changing account passwords or regenerating robot account tokens will not invalidate an unauthorized signing key.

Red Hat recommends administrators immediately restrict access to the key-management service.

Red Hat cautioned that removing malicious keys alone may not provide lasting protection until a fixed version is installed, as attackers could potentially reinstall them.

The vulnerability was discovered by Red Hat researcher Dave O'Connor. Fixes for the issue were merged into the project's GitHub repository on November 11.

Read more »
infostealer malware surge
AI Models AI Risks AI technology Cyber Security cybercriminals Data protection data stealing Doxing infostealer malware surge

Volta-Autodoxer Malware Uses Artificial Intelligence to Rank Victims and Build Detailed Personal Dossiers

 

Cybersecurity researchers at Cisco Talos have uncovered a new piece of malware known as Volta-Autodoxer (VOLTA) which uses commercial AI models to analyse the data it steals from Windows systems, identifying the most valuable targets. This shows that AI technology is now increasingly being used inside malware to automate processes. 

While traditional infostealers will steal sensitive data from infected systems such as saved passwords, browser cookies, payment card details, crypto wallet recovery phrases, authentication tokens and cloud credentials, the attacker often has to manually search through large amounts of data to identify valuable targets. Volta aims to cut this out using automated analysis of the victims data on the infected system. 

During the data collection phase, the malware will collect credentials, session data, Wi-Fi profiles, SSH keys, Microsoft OAuth tokens and screenshots of the desktop. It will also target Discord, Telegram, Steam and Roblox accounts to collect active session and account data. It will then use the stolen session tokens to access the victims main email accounts. This includes Gmail and Outlook. It will look at purchase confirmations and order history on services like Amazon, UberEats, DoorDash and Grubhub. This can give an insight into the victims home address, shopping habits, daily routines, work details and other personal information. It can also look up third-party services such as Rolimons to determine the resale value of their Roblox items. 

The malware will then organise the data it has collected and send it to OpenRouter, an API gateway that allows access to multiple AI models. The prompt inside the malware will tell the language model to act as a forensic intelligence analyst. It will create a detailed report on the victims and will identify if they could be valuable financially and how good their operational security is. The malware will use Anthropic’s Claude Opus 4.6 model by default. However, the developers have considered that there may be AI safety measures in place preventing the creation of malicious reports. 

The malware will look for rejection phrases such as 'I can’t’ in the models responses and switch to another provider if the request is denied. It will switch to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash. Once the report has been created, the malware will package the stolen data and AI report into ZIP files. These will be sent directly to the attackers via a Telegram channel. Files will be named things like volta_dox.zip. The malware was discovered by Cisco Talos during their research using the CAIRN research framework. 

The builder also has configurable fields suggesting that this malware may have been designed to be distributed or sold to other cybercriminals. While it has not been seen widely in the wild, it shows how AI can be used to help attackers target victims more effectively by automatically creating profiles. This makes the personal information stolen more useful for targeted cybercrime.
Read more »
Google
AI ai agents Cyber Security DeepMind Google

Google DeepMind AI Agents Reduce the Cost of Attacking 1024-Bit RSA Encryption


Artificial intelligence (AI) agents developed by Google DeepMind have shown new ways to make attacks against legacy RSA-1024 encryption systems significantly cheaper. 

The research was conducted by Google DeepMind in collaboration with cryptography researchers from the University of California San Diego and Inria. 

RSA is a widely used public-key cryptographic algorithm that relies on the mathematical difficulty of factoring large numbers. Although RSA-1024 was once considered sufficiently secure, advances in computing and cryptanalysis have made it unsuitable for protecting sensitive information. Modern systems generally use RSA keys of 2048 bits or longer.

The first major finding focused on digital signature forgery involving the PKCS#1 v1.5 padding format. Padding is additional data inserted into a message before signing to ensure that it meets the required block size. Researchers examined how this protection behaves when an attacker can influence the content of the message being signed.

The team found that when an attacker controls approximately half or more of the signed data block, the padding may no longer provide additional protection against forgery. This weakness is relevant to the PKCS#11 signing interface used by cryptographic devices, including hardware security modules.

To show the improvement, DeepMind's AI agents reproduced an earlier academic signature-forgery attack against an RSA-1024 key. The agents reduced the required computing time from approximately 1,380 CPU core-years to 391 CPU core-years, making the process around 3.5 times more efficient.

Two AI agents reportedly designed, executed and debugged the computation in less than four days, with approximately 20 messages from a human researcher, most of which involved approving their actions.

Researchers also developed a more efficient approach for situations where attackers control a smaller portion of the signed message, such as a 32-byte hash. Their theoretical calculations suggest that the proposed method could be approximately 1,600 times more efficient than the previous best approach for certain RSA-1024 signature-forgery scenarios.

The second major finding concerns RSA key factoring. RSA security depends on the difficulty of breaking down a large number into its original prime factors. The researchers developed an algorithm that could make factoring each additional RSA-1024 key approximately 30 times cheaper on average after an expensive initial computation.

However, this technique remains theoretical and has not yet been implemented. The initial computation would also require substantial resources, meaning the findings do not show an immediate practical attack against deployed encryption systems.

The researchers also highlighted important limitations of the signature-forgery technique. It requires approximately four billion signing queries in advance, does not recover the private key and does not work against devices that internally hash messages before signing.

According to Pushmeet Kohli, Vice President at Google DeepMind and Chief Scientist at Google Cloud, modern cryptographic protocols generally use RSA keys of 2048 bits or larger and remain secure against the demonstrated techniques.

Read more »
Hacker attack
Anti Malwares Cyber Security Developer Security GitHub GitHub malware Hacker attack

Hackers Infiltrate GitHub Projects to Infect Cybersecurity Developers With Advanced Malware

 

Cybercriminals are distributing malware through GitHub repositories designed to look like genuine development projects. Researchers at Doctor Web found malicious code in Microsoft Visual Studio projects, Python scripts and Go files. Over 2000 computers were reportedly infected with this malware. The campaign began around 2 years ago with the initial targets being cryptocurrency users. The repositories were themed around blockchain games, game bots and cheating tools. 

The repositories even included guidance for installing Visual Studio to make them seem more legitimate to less experienced developers. However the malware has now targeted information security professionals. The malicious code is hidden within repositories that claim to be for automated scanning, security testing and log analysis. The infected files have malicious code hidden in the configuration and source code of the repository. The malicious code is hidden with lots of white space. 

When the malicious project is downloaded, it runs PowerShell scripts that fetch further malicious files from external sources. This results in an archive being downloaded containing Microsoft.exe, which is a malware loader built with Electron. The malware has been identified as Trojan.Loader.3261. Once active, the malware gathers information about the system, creates persistence and downloads further payloads. It also tries to disable Windows Defender, User Account Control, alerts and recovery features. 

The malware uses various methods to avoid being monitored by security tools, hijack legitimate windows processes and avoid detection from endpoint detection systems. The malware includes payloads such as BackDoor.AsyncRAT.115 which allows the attacker to remotely access the infected computer. It also includes Trojan.InjectNET.14 which adds a cryptocurrency hijacker to the clipboard. This changes the copied wallet addresses to ones controlled by the attacker. 

It also takes screenshots of the infected system. The malware also includes JS.Stealer.191 which steals information from browsers, VPNs, messaging applications, gaming accounts, FileZilla and Discord. This information is zipped up and sent to the attacker via a Telegram bot. The malware tries to uninstall security tools from ESET, McAfee and Malwarebytes. It also changes the hosts file in windows to prevent access to certain anti virus domains. 

The researchers found multiple variations of how the malware was deployed. They also found other incomplete components which indicates that the malware is still being developed. Future features could include auto reinstall, better persistence, managing applications when they open and updating software. This shows that even information security professionals can be vulnerable to malicious resources. The researchers recommend checking any files you download, keeping anti virus databases up to date and being cautious when cloning unknown GitHub repositories.
Read more »
Email Security Getaways
Barracuda Bypass Flaw Critical Vulnerability Cyber Security Email Security Getaways

Barracuda Patches Two Security Flaws That Could Let Attackers Take Over Email Security Gateways


Experts have shown how two vulnerabilities in Barracuda's Email Security Gateway can be chained to execute arbitrary commands with root privileges without requiring an attacker to log in.

The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, affect Barracuda's email-filtering appliance and could allow remote attackers to bypass security restrictions and gain complete control of vulnerable systems.

According to cybersecurity firm watchTowr, which published its technical analysis, the attack chain combines an authorization bypass flaw with a command injection vulnerability. Barracuda released security patches for the issues earlier this week.

The first vulnerability, CVE-2026-116606, is an authorization bypass flaw that allows unauthenticated attackers to access a configuration restoration function and modify the appliance's global settings. The second, CVE-2026-111560, is a command injection vulnerability that enables commands to execute with root privileges.

Mandiant assigned CVSS severity scores of 9.3 and 8.6 to the two vulnerabilities, respectively.

How the attack chain works

In its technical investigation, watchTowr discovered that the authorization bypass stems from the appliance's password-change process. When a password change request fails, the system incorrectly returns a low-privilege user role instead of terminating the request completely.

The researchers also found that Barracuda's backup verification mechanism relies on a secret embedded within the appliance's code. Since this secret is not securely protected, attackers can generate a valid checksum for a specially crafted configuration backup and restore it on the targeted device.

The uploaded configuration can contain a manipulated timezone value. When the appliance processes this setting, it passes the value to a shell command that executes with root privileges.

watchTowr demonstrated the attack by successfully writing a file to the appliance with root-level permissions.

Affected products

CVE-2026-116606 affects Barracuda Email Security Gateway, while CVE-2026-111560 impacts five additional products, including Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).

However, the complete unauthenticated attack chain applies specifically to Email Security Gateway. Exploitation of the command injection vulnerability on the other affected products requires administrator access.

What next?

Barracuda has released security updates addressing both vulnerabilities and recommends that customers install the appropriate patches or upgrade to the latest fixed firmware versions.

As of the disclosure, neither vulnerability had been listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no publicly reported incidents linked the flaws to active exploitation.

Read more »
RBI Data Centre
AI Security Banking Security Cyber Security cybersecurity risks Cybersecurity Training Institute data sovereignty Digital Banking Financial Cybersecurity India's Digital Infrastructure RBI Data Centre

Data Sovereignty Is Essential for India's Digital Infrastructure, Says RBI Governor


Sanjay Malhotra, Governor of the Reserve Bank of India (RBI), emphasized the significance of maintaining sovereign data centers in order to safeguard critical financial information and strengthen the country's digital infrastructure. As information technology has become an integral part of the banking industry, security infrastructure, operational resilience, and cybersecurity have become increasingly important in maintaining financial stability, especially in light of the growing threat landscape being shaped by artificial intelligence (AI). 


Prime Minister Narendra Modi inaugurated the RBI's new data center complex and Cybersecurity Training Institute in Bhubaneswar on October 25, and made these remarks following the inauguration. With a capital investment of Rs 169 crore, the facility is expected to enhance the reliability of critical financial services and to reduce the likelihood that essential banking operations will be disrupted.

A spokesperson for Doordarshan reported that Malhotra explained that the central bank's technology infrastructure facilitates the use of applications by the general public, financial institutions, and government departments. He pointed out that information technology cannot be considered merely a supporting function, as several essential financial operations are directly dependent upon the availability and security of these technologies. 

NEFT and RTGS are major payment infrastructures that will be supported by the new data center. Furthermore, the RBI's integrated ombudsman system and applications used by financial institutions regulated by the central bank will be supported by the new data center. In addition to government banking operations, it will also accommodate financial institutions regulated by the RBI. 

A key component of Malhotra's statement was the RBI's role in the Unified Payments Interface (UPI) ecosystem in India. Although UPI is operated by the National Payments Corporation of India (NPCI), final settlement of transactions takes place through the RBI's data centres and applications. To ensure the availability of the central bank's infrastructure within the wider digital payments ecosystem, it is important. 

Four independent data centres are located within the Bhubaneswar complex, which has been accredited as Tier IV by the Uptime Institute, the highest level of its data centre classification. This facility will be operated independently of third party cloud service providers, allowing RBI to maintain greater control over its critical infrastructure and sensitive financial information. Additionally, the project's geographical location will contribute to its resilience. 

A geographically separated and seismically isolated location in Bhubaneswar reduces the possibility that a localised disruption will affect all facilities simultaneously. The RBI previously operated three data centers in Maharashtra. Additionally, this development reflects the increasing importance of data sovereignty in the Indian financial infrastructure, where uninterrupted access to critical systems and the control of sensitive information remain essential security priorities. 

As part of the RBI's infrastructure security efforts, cybersecurity expertise is also being developed throughout the financial sector. In the Bhubaneswar project, there will be a Cybersecurity Training Institute, which will occupie approximately two-thirds of the campus, and the remaining portion will accommodate the data centre. It is intended that the institute will provide training to personnel of the RBI, bank employees, and professionals from other financial institutions. 

A number of emerging technologies, such as artificial intelligence (AI), big data analytics, quantum technology, and blockchain, will be studied as part of its programming. There will also be research activities conducted in order to investigate ways to improve the security and efficiency of financial systems. With AI posing new challenges to financial institutions, specialized training is becoming increasingly important.

The technology can provide opportunities for improving banking operations and security monitoring; however, if it is misused, it can result in cyberattacks, automated fraud, and attempts to exploit weaknesses in digital systems, increasing in sophistication. Financial sector readiness therefore relies heavily on cybersecurity professionals staying up to date on these developments. 

Governor of the Reserve Bank, Sanjay Malhotra, stressed the need to maintain personnel informed of technological developments and the growing importance of cybersecurity in the context of artificial intelligence. By attending the institute, financial sector professionals will be better equipped to comprehend emerging risks and respond to changes in cybersecurity. In addition to investing in digital infrastructure, the initiative emphasizes the importance of building human expertise. 

For data centers and advanced technology systems to be secure, trained professionals must manage operations, identify security weaknesses, and ensure service reliability are required. It was pointed out during the inauguration that cybersecurity was directly related to India's economic security by Prime Minister Narendra Modi. As financial services become increasingly dependent on digital technologies and digital banking, it becomes increasingly important to protect the financial infrastructure.

As well as highlighting the institute's role in developing cybersecurity and emerging technologies, Finance Minister Nirmala Sitharaman also highlighted the institute's efforts. Due to its emphasis on energy efficiency and water conservation, the RBI has also applied for a Platinum rating with the Indian Green Building Council. 

Bhubaneswar represents a larger effort to strengthen India's control over critical financial technology infrastructure by incorporating locally sourced materials in its construction approach. To protect the country's financial ecosystem, sovereign data management, geographically distributed infrastructure, and specialized cybersecurity training will remain important. As digital payments and artificial intelligence-driven services continue to increase, a comprehensive data management system, geographically distributed infrastructure, and cybersecurity training will be essential. 

An important strategic investment is being made in Indian financial infrastructure with the establishment of the sovereign data centre and cybersecurity training institute. In order to enhance the long-term reliability and resilience of the country's digital financial systems, the RBI intends to strengthen control over critical financial data and develop specialised cybersecurity expertise.
Read more »
fake remote tech jobs
AI Deepfakes AI Powered Scams AI Risks AI technology AI Voice Scam Cyber Security Cyberscams deepfake scams fake remote tech jobs

AI-Powered CEO Impersonation Scheme Allegedly Defrauded Companies of $129 Million

 

Three men have been indicted in the United States for an alleged international fraud scheme in which they used artificial intelligence to impersonate corporate executives and legal professionals to trick employees into sending around $129 million to their accounts. 

Jacob Soall, Sharon Hazan and Guy Sheetrit have been charged with pretending to be company CEOs and lawyers to convince employees that large transactions were needed. Between 2024 and 2026, the trio allegedly conspired to use AI to create fake audio and video of real people, according to the U.S. Department of Justice. They used AI to make their impersonations realistic enough to fool corporate workers. 

The trio now face numerous charges including wire fraud, money laundering and aggravated identity theft. If they are found guilty, they could face a maximum sentence of 104 years in prison. They called employees and pretended to be their company’s chief executive, with the alleged fraudsters claiming they needed urgent financial transactions to be completed and that it was confidential. They would then tell employees to contact lawyers on behalf of the company. 

AI was used to create copies of the lawyers’ voices and appearances. Soall was reported to have taken on the role of impersonating lawyers and had scripts ready to mimic how they would speak. Once they had convinced employees to approve the transactions, the money was sent through bank accounts in the United States, Europe, the United Arab Emirates and China. 

The cash was then transferred into cryptocurrency. Several organisations were allegedly scammed including a hospital in Missouri who lost almost $5 million, a bank in Rhode Island who lost $2.6 million and a hospital in California who lost $2.9 million. Other alleged victims included a technology company in the UK who lost $11.5 million, a financial company in Massachusetts who lost $4.6 million and a pet food company in Florida who lost $5.2 million. Hazan is alleged to have managed the money laundering. 

In court documents, Hazan claimed he had laundered $400 million since 1994. He was previously convicted of bank fraud in 2008. All three suspects are currently in custody. Soall and Hazan were arrested in Spain during the summer whilst Sheetrit was detained in the United Kingdom in September. The Justice Department said they are all facing extradition requests. 

The FBI has warned criminals are increasingly using new technology to commit complex financial frauds. James Barnacle, a senior FBI official, said the alleged fraud is an example of how sophisticated technology can be used to commit large-scale crime. The bureau has encouraged businesses who may have been targeted to report any suspected incidents.
Read more »
Subscribe to: Posts (Atom)