Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Barracuda Patches Two Security Flaws That Could Let Attackers Take Over Email Security Gateways

Experts have shown how two vulnerabilities in Barracuda's Email Security Gateway can be chained to execute arbitrary commands with root ...

All the recent news you need to know
RBI Data Centre
AI Security Banking Security Cyber Security cybersecurity risks Cybersecurity Training Institute data sovereignty Digital Banking Financial Cybersecurity India's Digital Infrastructure RBI Data Centre

Data Sovereignty Is Essential for India's Digital Infrastructure, Says RBI Governor


Sanjay Malhotra, Governor of the Reserve Bank of India (RBI), emphasized the significance of maintaining sovereign data centers in order to safeguard critical financial information and strengthen the country's digital infrastructure. As information technology has become an integral part of the banking industry, security infrastructure, operational resilience, and cybersecurity have become increasingly important in maintaining financial stability, especially in light of the growing threat landscape being shaped by artificial intelligence (AI). 


Prime Minister Narendra Modi inaugurated the RBI's new data center complex and Cybersecurity Training Institute in Bhubaneswar on October 25, and made these remarks following the inauguration. With a capital investment of Rs 169 crore, the facility is expected to enhance the reliability of critical financial services and to reduce the likelihood that essential banking operations will be disrupted.

A spokesperson for Doordarshan reported that Malhotra explained that the central bank's technology infrastructure facilitates the use of applications by the general public, financial institutions, and government departments. He pointed out that information technology cannot be considered merely a supporting function, as several essential financial operations are directly dependent upon the availability and security of these technologies. 

NEFT and RTGS are major payment infrastructures that will be supported by the new data center. Furthermore, the RBI's integrated ombudsman system and applications used by financial institutions regulated by the central bank will be supported by the new data center. In addition to government banking operations, it will also accommodate financial institutions regulated by the RBI. 

A key component of Malhotra's statement was the RBI's role in the Unified Payments Interface (UPI) ecosystem in India. Although UPI is operated by the National Payments Corporation of India (NPCI), final settlement of transactions takes place through the RBI's data centres and applications. To ensure the availability of the central bank's infrastructure within the wider digital payments ecosystem, it is important. 

Four independent data centres are located within the Bhubaneswar complex, which has been accredited as Tier IV by the Uptime Institute, the highest level of its data centre classification. This facility will be operated independently of third party cloud service providers, allowing RBI to maintain greater control over its critical infrastructure and sensitive financial information. Additionally, the project's geographical location will contribute to its resilience. 

A geographically separated and seismically isolated location in Bhubaneswar reduces the possibility that a localised disruption will affect all facilities simultaneously. The RBI previously operated three data centers in Maharashtra. Additionally, this development reflects the increasing importance of data sovereignty in the Indian financial infrastructure, where uninterrupted access to critical systems and the control of sensitive information remain essential security priorities. 

As part of the RBI's infrastructure security efforts, cybersecurity expertise is also being developed throughout the financial sector. In the Bhubaneswar project, there will be a Cybersecurity Training Institute, which will occupie approximately two-thirds of the campus, and the remaining portion will accommodate the data centre. It is intended that the institute will provide training to personnel of the RBI, bank employees, and professionals from other financial institutions. 

A number of emerging technologies, such as artificial intelligence (AI), big data analytics, quantum technology, and blockchain, will be studied as part of its programming. There will also be research activities conducted in order to investigate ways to improve the security and efficiency of financial systems. With AI posing new challenges to financial institutions, specialized training is becoming increasingly important.

The technology can provide opportunities for improving banking operations and security monitoring; however, if it is misused, it can result in cyberattacks, automated fraud, and attempts to exploit weaknesses in digital systems, increasing in sophistication. Financial sector readiness therefore relies heavily on cybersecurity professionals staying up to date on these developments. 

Governor of the Reserve Bank, Sanjay Malhotra, stressed the need to maintain personnel informed of technological developments and the growing importance of cybersecurity in the context of artificial intelligence. By attending the institute, financial sector professionals will be better equipped to comprehend emerging risks and respond to changes in cybersecurity. In addition to investing in digital infrastructure, the initiative emphasizes the importance of building human expertise. 

For data centers and advanced technology systems to be secure, trained professionals must manage operations, identify security weaknesses, and ensure service reliability are required. It was pointed out during the inauguration that cybersecurity was directly related to India's economic security by Prime Minister Narendra Modi. As financial services become increasingly dependent on digital technologies and digital banking, it becomes increasingly important to protect the financial infrastructure.

As well as highlighting the institute's role in developing cybersecurity and emerging technologies, Finance Minister Nirmala Sitharaman also highlighted the institute's efforts. Due to its emphasis on energy efficiency and water conservation, the RBI has also applied for a Platinum rating with the Indian Green Building Council. 

Bhubaneswar represents a larger effort to strengthen India's control over critical financial technology infrastructure by incorporating locally sourced materials in its construction approach. To protect the country's financial ecosystem, sovereign data management, geographically distributed infrastructure, and specialized cybersecurity training will remain important. As digital payments and artificial intelligence-driven services continue to increase, a comprehensive data management system, geographically distributed infrastructure, and cybersecurity training will be essential. 

An important strategic investment is being made in Indian financial infrastructure with the establishment of the sovereign data centre and cybersecurity training institute. In order to enhance the long-term reliability and resilience of the country's digital financial systems, the RBI intends to strengthen control over critical financial data and develop specialised cybersecurity expertise.
Read more »
Hoax
Cyber Attacks cybersecurity in healthcare cybersecurity risks Email Account Security Email Attacks Email Spoofing Hoax

Bogotá Investigates Possible Health Agency Email Compromise Linked to European Airport Bomb Hoax

 

Authorities in Bogota, Colombia, have opened an investigation into whether an email account used by a public health agency was accessed without authorisation or if it was spoofed in a bomb threat email sent to an airport in Europe. The threat comes after a wave of bomb threats via email has caused chaos at airports throughout Europe since Monday. Flights have been diverted, and security checks and searches have been conducted but so far no devices have been found. 

In the Bogota related email seen by Recorded Future News, the message was sent to contacts in Rome’s Fiumicino Airport and appeared to be sent using the Subred Sur Occidente domain. This is a public hospital network covering the southern west of Bogota. The email said there were explosives on board two flights heading to Rome. One was a Finnair flight from Helsinki which was escorted into Rome by Italian Air Force fighter jets. The other was an Aer Lingus flight which was diverted to a French military base. 

Bogota’s mayor’s office has confirmed it received an international alert regarding a possible use of an email address used by a health agency in the city. An investigation has been ordered to find out what happened, according to a statement on the Subred Sur Occidente website. The administration also highlighted that there have been suspected cyber-attacks on public institutions recently. It cannot be ruled out that international hackers have been involved or that government email addresses have been compromised. 

It is still being investigated whether the email account used by the hospital network was used to send the threat, or if it was just spoofed. There is also no evidence to currently link staff from the health agency to the threat or why the domain was chosen. Several of the threats to European airports have been signed off with names linked to a Russian misogynistic group which is banned in Russia. 

However experts have warned that this does not mean they can be blamed. The threats have also been sent to several Irish media outlets on Friday. The messages claimed to be linked to the same group. The Irish government have said the threats to media outlets are serious and it is not clear if they have come from individuals or an organised effort. 

However the timing and similarities to the airport disruptions mean it is likely to be an organised campaign. A spokesperson for the Taoiseach of Ireland could not be immediately reached to ask if the government’s statement was based on any specific intelligence. It is not known who has sent the series of threats.
Read more »
Technology
Chinese companies FCC cybersecurity Hardware supply chain Technology

FCC Starts Blocking Devices for What's Inside Them, Then Gives Intel a Pass

 



The Federal Communications Commission moved this month to block two consumer gadgets from the American market, not because of who made them, but because of a chip buried inside. A dashcam and a wireless video transmitter both contained components manufactured by HiSilicon, a Huawei subsidiary, putting them on the wrong side of a rule that took effect October 13 and extends Washington's existing tech blacklist deep into the supply chain.

The same day those products were pulled, October 22, the FCC handed Intel a one-year reprieve for the foreign-built robots running in its semiconductor factories. The two decisions landed together, and together they sketch the shape of a problem that will follow this policy for years.


What Changed and Why It Matters

The FCC has maintained what it calls the Covered List since 2021, a register of foreign technology companies whose products are deemed national security risks. Placement on the list means a company's equipment cannot receive radiofrequency authorization in the United States, which amounts to a ban on importing and selling it here. For years, the restriction was straightforward: it applied to products built by listed companies. Huawei was on the list; Huawei routers were blocked.

The new Third Report and Order changed the terms. It bars RF authorization for any device that incorporates logic-bearing components from a Covered List entity, so long as the end product itself would have been blocked. The two gadgets flagged on October 22 were the first to be caught under this framework, but they will not be the last.

The FCC's characterization of the HiSilicon chips is worth noting. The agency called them "foreign surveillance chips" and cited their "built-in detection algorithms for human faces," a feature sold to consumers as a way to identify strangers near a home. HiSilicon is a Huawei subsidiary, and Huawei is already on the Covered List, which is what triggered the rule. FCC Chairman Brendan Carr praised the enforcement action and said more would follow.

"Manufacturers must now conduct their own supply chain audits to determine whether any of their parts trigger the rule, with limited guidance on where to look."


A Rule With Gaps

The logic is clean on paper. If a company is considered a threat, its chips should not enter American products regardless of who assembles them. But applying that logic requires knowing what is inside a device, and that is harder than it sounds.

No authoritative list currently exists identifying which companies manufacture covered components. Huawei itself did not name HiSilicon in a 2023 subsidiary disclosure filing to the FCC. That gap means the burden of compliance falls on manufacturers who must audit their own supply chains, often without clear guidance on which subsidiaries or affiliates to look for. A separate FCC proceeding that would require Covered List entities to submit complete subsidiary and affiliate disclosures is still pending and not yet in effect.

The rule's reach also has limits. It applies only to components made by entities actually named on the Covered List. Unnamed manufacturers of foreign industrial robots or consumer routers, for instance, do not fall under it, even if those products are covered under the separate "sector-based" rules the FCC introduced for certain product categories starting in December 2025.


Intel's Narrow Escape, and Its Clock Problem

When the FCC added humanoid robots, quadrupeds, and other industrial robotic devices to the Covered List in July 2026, it created an immediate operational problem for Intel. The company's semiconductor fabrication plants run on automated guided vehicles, or AGVs, purpose-built machines that shuttle materials across factory floors. Intel says these machines have been in continuous operation for roughly two decades and that no American-made alternatives meet its technical requirements.

Intel applied for relief before it was clear the rule even applied to its machines, flagging the uncertainty in its filing. The FCC granted a one-year hardware waiver on October 22, the first of its kind in the robotics category. Intel committed to keeping the vehicles on-site under its control, making no changes that would improve their RF characteristics, and not introducing new capabilities.

The problem is the timeline. The hardware waiver expires in October 2027. A separate waiver covering software and firmware updates on the same machines runs through January 2029, leaving a 15-month gap between the two deadlines. Replacing industrial robots typically requires years of commissioning, procurement evaluation, and integration work, a timeline that does not fit inside 12 months. At least one industry analyst has described the arrangement as "a temporary fix for a long-term problem." Intel will need to identify domestic alternatives, pursue an extension, or seek a longer-term exemption well before next fall's deadline.


What Comes Next

The FCC's Covered List has been moving in one direction: more products, more companies, more components. Drones, consumer-grade routers, power inverters, and now industrial robots have all been added to sector-based restrictions that cover foreign-produced products across entire categories, regardless of which specific company made them. Companies operating in those sectors can apply to the Department of Homeland Security or the Department of War for conditional approval, which requires committing to a domestic manufacturing onshoring plan.

The two decisions on October 22 sit on opposite ends of that spectrum. The HiSilicon enforcement shows the new component rule starting to bite, pulling products off the market that passed previous scrutiny because the finished gadget was not made by a listed company. The Intel waiver shows how far the domestic alternative market still has to go before the restrictions can hold without exceptions. The list is getting sharper. The supply chain it assumes into existence is still being assembled.



Read more »
Vulnerabilities and Exploits
Linux Systems OpenSSH SSHole Vulnerabilities and Exploits

Hackers Exploit OpenSSH SSHole Flaw Within Hours

 

A newly disclosed OpenSSH vulnerability, nicknamed SSHole, is already being exploited in the wild. The flaw, tracked as CVE-2026-123158 and carrying a CVSS score of 8.1, lets unauthenticated attackers log in to certain Linux accounts that have no usable password set. Security firm Previdian observed the first exploitation attempt less than nine hours after the vulnerability was published, and confirmed successful root access on an Alpine Linux honeypot. 

The issue affects Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. Alpine Linux’s default OpenSSH server configuration is among the affected setups. An attacker can send an oversized password—between 257 and 1,024 bytes—to trigger the bug and gain access to accounts configured with an asterisk (*) as their password hash. This means attackers do not need to steal SSH keys or valid credentials to obtain access. 

SSHole stems from password-handling behavior linked to a 2016 patch for CVE-2016-6210, a username-enumeration flaw. Under the specific conditions, OpenSSH mistakenly treats a failed password-hashing operation as successful authentication because it produces the same asterisk value used to mark password-disabled accounts. The SSH daemon then compares that value with the account’s stored password field and allows the login. Importantly, the flaw does not bypass passwords on accounts that have valid password hashes. 

The consequences depend heavily on the privileges of the compromised account. A successful attack grants the attacker the permissions already held by that account, which could include access to deployment credentials, application secrets, and connected infrastructure. From there, intruders may move laterally across systems or disrupt services. The vulnerability does not affect Dropbear, glibc-based Linux distributions, non-Linux systems, or systems that authenticate passwords through PAM.

Administrators should act quickly by installing OpenSSH 10.6p2 or their distribution’s patched package and restarting the sshd service. Alpine also advises reviewing /var/log/messages for “Accepted password for” entries involving accounts that should not accept password logins, including root, Alpine, or key-only users. Administrators should inspect recent users, files, authorized keys, and doas usage; if a suspicious login cannot be ruled out, the system should be treated as compromised.
Read more »
fake remote tech jobs
AI Deepfakes AI Powered Scams AI Risks AI technology AI Voice Scam Cyber Security Cyberscams deepfake scams fake remote tech jobs

AI-Powered CEO Impersonation Scheme Allegedly Defrauded Companies of $129 Million

 

Three men have been indicted in the United States for an alleged international fraud scheme in which they used artificial intelligence to impersonate corporate executives and legal professionals to trick employees into sending around $129 million to their accounts. 

Jacob Soall, Sharon Hazan and Guy Sheetrit have been charged with pretending to be company CEOs and lawyers to convince employees that large transactions were needed. Between 2024 and 2026, the trio allegedly conspired to use AI to create fake audio and video of real people, according to the U.S. Department of Justice. They used AI to make their impersonations realistic enough to fool corporate workers. 

The trio now face numerous charges including wire fraud, money laundering and aggravated identity theft. If they are found guilty, they could face a maximum sentence of 104 years in prison. They called employees and pretended to be their company’s chief executive, with the alleged fraudsters claiming they needed urgent financial transactions to be completed and that it was confidential. They would then tell employees to contact lawyers on behalf of the company. 

AI was used to create copies of the lawyers’ voices and appearances. Soall was reported to have taken on the role of impersonating lawyers and had scripts ready to mimic how they would speak. Once they had convinced employees to approve the transactions, the money was sent through bank accounts in the United States, Europe, the United Arab Emirates and China. 

The cash was then transferred into cryptocurrency. Several organisations were allegedly scammed including a hospital in Missouri who lost almost $5 million, a bank in Rhode Island who lost $2.6 million and a hospital in California who lost $2.9 million. Other alleged victims included a technology company in the UK who lost $11.5 million, a financial company in Massachusetts who lost $4.6 million and a pet food company in Florida who lost $5.2 million. Hazan is alleged to have managed the money laundering. 

In court documents, Hazan claimed he had laundered $400 million since 1994. He was previously convicted of bank fraud in 2008. All three suspects are currently in custody. Soall and Hazan were arrested in Spain during the summer whilst Sheetrit was detained in the United Kingdom in September. The Justice Department said they are all facing extradition requests. 

The FBI has warned criminals are increasingly using new technology to commit complex financial frauds. James Barnacle, a senior FBI official, said the alleged fraud is an example of how sophisticated technology can be used to commit large-scale crime. The bureau has encouraged businesses who may have been targeted to report any suspected incidents.
Read more »
Web Hosting Security
Control Web Panel CWPdoor Malware Cybersecurity Threats Linux Backdoor Linux Server Security Malware Remote Code Execution Server Malware Trojanized Web Server Web Hosting Security

Hackers Exploit Malicious CWP Web Server to Backdoor Linux Systems


Linux backdoors have been discovered that have been maliciously implanted into servers that are running Control Web Panel (CWP) via trojanized versions of its web server component, raising concerns about the security of hosting infrastructure in general. By crafted HTTP requests, attackers are able to execute commands remotely while concealing their activity from normal server access logs, a technique known as CWPdoor. 

The malware was discovered by security researchers at XLab, the research division of QiAnXin Technology Group, on June 29 after capturing a malicious shell script. Scripted updates disguised themselves as legitimate software updates, replacing the original cwpsrv binary with a modified version that included a backdoor. Versions of Web Servers 1.15.10 and 1.24.0 were affected. 

The CentOS Web Panel was previously known as the CentOS Web Panel, which is a free open-source web hosting management system for managing Linux servers and services, including email, DNS and databases. A web server component, known as CWPsrv, is responsible for handling requests to the management interface, making this compromise of particular concern to server administrators. During the month preceding the investigation, more than 340,000 CWP instances were exposed on the internet, according to XLab. 

Even though public exposure does not guarantee infection, the number of attacks targeting this software indicates the potential reach of such attacks. 

Malicious Update Script Conceals the Infection

CWPdoor infections begin with scripts modifying the legitimate CCWPSRV executable with a trojanized version. In addition to installing the malicious binary, the script performs several other actions intended to make detection difficult. As a result, files and directories affected by the virus are restored to their original timestamps, temporary installation files are removed, and command history records are cleared.

Through these methods, the replacement is less visible and routine administrative checks are less effective. The malware does not behave like a conventional backdoor that continually listens for incoming connections, but instead remains dormant until its operators issue a specially constructed HTTP request that triggers its operation. Consequently, ordinary network monitoring is unable to detect the threat due to its passive execution method. 

The compromised web server continues to perform its legitimate functions while maintaining the ability to execute attacker-controlled commands when a valid request arrives. In particular, XLab described the malware as exceptionally stealthy, owing to its request validation mechanism and ability to interfere with server logging. By using these capabilities, a backdoor can be concealed within a trusted component of the server rather than appearing as a standalone process that appears to be suspicious. 

Encrypted Requests and Log Manipulation Hide Attacker Activity 

A malicious HTTP request carries three custom headers that are used by CWPdoor to control the execution of attacker commands. CWPdoor utilizes encryption and digital signature verification to ensure that attacker commands are executed in a controlled manner. X-Ngx-Integrity-Data contains an encrypted command; X-Ngx-Integrity-Time specifies a timestamp; and X-Ngx-Integrity-Sig contains an RSA signature. 

The backdoor validates the RSA signature before executing a command. The malware decrypts the command once it has passed these checks and forwards it to the helper process for execution. Both commands and their output are protected using AES-256-CBC encryption. With the signature mechanism, attackers or external parties are also prevented from altering the encrypted payload or timestamp without invalidating the request. 

As a result, the backdoor can only be activated when the request has been correctly signed, providing replay protection. CWPdoor has also been shown to suppress evidence of malicious activity in a significant way. It interferes with the logging module of the web server, preventing regular access log entries from displaying requests that trigger the backdoor. During routine security investigations, this can lead to administrators lacking crucial evidence. 

VirusTotal Sample Points to Active Infections

The analysis indicated that the CWPdoor sample had been uploaded to VirusTotal on September 30, along with the Ebury backdoor. Researchers discovered that the trojanized cwpsrv binary did not receive a single antivirus detection out of 63 security products tested. The discovery indicates that the malware has reached beyond testing and is already present on compromised systems. 

It is unclear, however, whether CWPdoor and Ebury are operated by the same threat actors or whether they were installed independently on the same server. Ebury is an extensive Linux malware operation known for its backdoors and credential stealing capabilities. Since the malware was first identified in 2009, ESET reported that nearly 400,000 servers were compromised. 

XLab Shares Detection and Mitigation Measures

This malware has been identified by XLab. It is recommended that administrators inspect CWP servers for specific indicators associated with it. These include the ngx_http_integrity_helper Unix socket, unexpected helper processes launched by cwpsrv, and strings containing X-Ngx-Integrity. It is also recommended to check the integrity of the cwpsrv executable rather than relying on file timestamps, because the malicious installer may restore the values of the file timestamps to conceal unauthorized modifications, according to researchers. 

A legitimate copy of the web server binary should be restored by administrators, the CWP must be updated to the newest version, and all control panel credentials must be rotated. Furthermore, the affected host should be subjected to an extensive security investigation to determine whether it has been infected with malware or unauthorized access.

Because CWPdoor is capable of executing attacker-supplied commands, replacing the compromised binary may not be sufficient to secure the system. Server credentials, including privileged access accounts, should be treated as potentially vulnerable.
Read more »
Subscribe to: Posts (Atom)

Featured