Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Conti Ransomware Ties Lead to Four-Year Prison Sentence

Ukrainian nationals have been sentenced to four years in U.S. prison for participating in the Conti ransomware operation. Between 2020 and 2...

All the recent news you need to know
Data Stolen
Credential Credential stealing Credential Theft Data Breach Data Leak data security Data Stolen

Florida Says Motor Vehicle Data Breach Tied to Credentials Stolen From Officer's Personal Device

 

Officials in Florida confirmed Thursday that the state Department of Motor Vehicles suffered a data breach after credentials were stolen from a police officer who had stored login information on a personal device. The ShinyHunters cybercriminal organization claimed on Monday that it had obtained access to data from the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). 

The department did not respond to repeated requests for comment throughout the week but publicly confirmed the breach's legitimacy on Thursday night. Officials said they first learned of the breach on September 4 and initially attributed it to an unnamed "international cybercriminal organization." 

According to the department, an investigation determined that a criminal actor exploited a single Plant City Police Department user's credentials, which had been improperly stored on the employee's personal electronic device. Plant City is a small suburb outside Tampa. FLHSMV has since notified other Florida government offices and is partnering with the Florida Digital Service to investigate the incident. 

As proof of access, ShinyHunters shared alleged photos of a DMV record tied to American financier and convicted child sex offender Jeffrey Epstein. When claims of the breach first surfaced, some cybersecurity experts speculated it might be connected to the recently confirmed breach involving 153 million driver's licenses leaked by identity verification firm IDScan. ShinyHunters had previously attempted to purchase the ID database from the hackers behind the IDScan breach.

The group has recently claimed responsibility for attacks on bank IT provider Jack Henry, as well as pharmaceutical and healthcare technology company McKesson, which told regulators that data from its oncology and surgical business units had been stolen. ShinyHunters also caused widespread disruption across the U.S. in May with an attack on a widely used educational software suite and stole the information of more than four million people after targeting the world's largest medical device company in April. 

Other victims linked to the group include Carnival Cruises, Ticketmaster, AT&T, McGraw Hill, ADT, and gaming company Rockstar. In a related development, artificial intelligence company Anthropic released a report Thursday stating that suspected affiliates of ShinyHunters used AI to scan for credentials, map unfamiliar systems, and steal data from victims for extortion purposes. 

The report noted that in one case, an operator escalated from a stolen developer token to full administrative access over a victim's cloud environment in approximately three hours. Incident responders at Google also confirmed last week that members of the group are using Anthropic's AI tools at various stages of their attacks. 

The Florida breach adds to a growing list of incidents tied to ShinyHunters, underscoring the group's persistent targeting of both government systems and major corporations, as well as its evolving use of AI tools to accelerate and scale its intrusions.
Read more »
watchTowr
API CISA Code Injection Vulnerability CVSS GitLab patches Vulnerabilities and Exploits watchTowr

GitLab's Worst-Rated Vulnerability Is Already Being Exploited

 



GitLab on September 10 shipped emergency patches for a maximum-severity vulnerability that lets unauthenticated attackers read arbitrary files off a server and by the following morning, attackers were already hunting for unpatched instances.

The flaw, tracked as CVE-2026-85706, carries a CVSS score of 10.0, the highest rating a vulnerability can receive. It sits inside GitLab's repository commits API, where improper path confinement combined with missing authentication enforcement allows an outside attacker to break out of the intended directory structure and pull files from elsewhere on the server. According to watchTowr, the firm that first flagged in-the-wild activity, those files include log entries and GitLab-specific configuration files that may contain credentials, secrets, and sensitive system details.

The requirement for exploitation is notably low. A GitLab instance needs at least one public project for the attack to work and no credentials are required at all.

"watchTowr Intel is already observing in-the-wild probes for the latest critical GitLab path traversal vulnerability, CVE-2026-85706, which allows attackers to read arbitrary files in a single HTTP request," the firm said on September 11, noting that scanning activity had begun as early as 06:00 UTC that morning, within hours of GitLab's patch publication the day before.

Jake Knott, head of threat intelligence at watchTowr, told this publication: "The appeal to attackers of GitLab is obvious, as unauthorized access allows an attacker to gain access to source code, CI/CD secrets, credentials, and the ability to inject code into build pipelines, gaining access or poisoning anything downstream of it, which as we've seen throughout this year has been a favorite of attackers."


What Gets Exposed

GitLab sits at the center of most software delivery pipelines. A server running GitLab may hold proprietary source code, container build definitions, infrastructure-as-code configurations, API keys baked into CI/CD scripts, deployment credentials, and runner access tokens. A vulnerability that lets an outside party read files off the server without logging in is effectively a master key to an organization's software supply chain.

CISA, which added the vulnerability to its Known Exploited Vulnerabilities catalog on September 11, noted that arbitrary file disclosure can help attackers identify credentials, configuration details, and other information useful for follow-on intrusion activity. The agency also flagged the vulnerability under Binding Operational Directive 26-04, requiring forensic triage because some affected instances may have been accessed before patches were even available. 

Knott warned that full-scale exploitation is not far off: "Based on the history, the transition of this vulnerability to indiscriminate mass exploitation is likely not far away, and defenders have limited time to act."


Two More Critical Bugs in the Same Release

The patch bundle that addressed CVE-2026-85706 also closed two additional high-severity vulnerabilities, making this one of GitLab's more consequential security updates in recent memory.

The second issue, CVE-2026-87719, carries a CVSS score of 9.9. It is an insecure deserialization flaw inside the GraphQL subscription serializer that affects only GitLab Enterprise Edition. An attacker who already holds an authenticated account with Duo Chat access can submit a specially crafted GraphQL subscription argument to bypass serialization controls and trigger server-side object lookup, potentially exposing Advanced Search instance configurations and sensitive credentials. Unlike the path traversal issue, this one requires an existing foothold — but an insider, a compromised account, or an attacker who has already gained limited access could use it to escalate what they can see. 

A third vulnerability, CVE-2026-88765, is a buffer overflow in GitLab EE's Unicode conversion wrapper with a CVSS score of 8.5 that could allow an authenticated attacker to achieve remote code execution by importing a specially crafted Git project export. The overflow occurs during Advanced Search indexing, which means any instance that accepts project imports is in scope.

All three vulnerabilities are fixed in GitLab versions 19.3.2, 19.2.6, and 19.1.8, released September 10. GitLab.com and GitLab Dedicated customers do not need to take action the fixes were applied on their behalf.


A Pattern That Is Getting Harder to Ignore

CVE-2026-85706 is not an isolated incident. It is the second critical GitLab vulnerability to come under active exploitation within days of disclosure in roughly six weeks.

In August, GitLab released an emergency security update outside its normal twice-monthly schedule to address CVE-2026-19478, a code injection vulnerability in its GraphQL API carrying a CVSS score of 9.4. That flaw allowed unauthenticated attackers to modify or delete publicly accessible projects and user data through a GraphQL directive, requiring no credentials and no user interaction. 

WatchTowr warned at the time that it was able to reproduce that vulnerability within minutes of disclosure, armed only with GitLab's advisory details and the patch itself. Exploitation followed within roughly 48 hours. 

Knott made the connection explicit: "This is the second instance of a critical-severity GitLab vulnerability in recent weeks, following the previous GraphQL code injection (CVE-2026-19478) that was almost immediately actively exploited."

Internet-wide scanning data puts the number of self-managed GitLab instances reachable on standard web ports at more than 20,000, based on Shodan and Censys lookups, with a meaningful share still running versions inside the vulnerable range days after patches ship. That pool of exposed servers gives attackers a large, persistent target and the repeated pattern of fast exploitation suggests that, at minimum, automated scanning tools are picking up GitLab advisories and moving on them within hours. 


What Defenders Need to Do Now

CISA has given Federal Civilian Executive Branch agencies until September 14 to apply the fix. Private sector organizations running self-managed GitLab do not have a regulatory deadline, but the window between disclosure and mass exploitation has been narrowing with each successive GitLab vulnerability this year.

Any internet-facing instance should be treated as potentially compromised until confirmed otherwise if it was exposed before September 10, because active in-the-wild probes began at 06:00 UTC on September 11, meaning any unpatched server was under active attack within hours of the patch release.

Knott recommended a specific log-hunting approach for teams that cannot patch immediately: review HTTP POST requests to /api/v4/projects/{id}/repository/commits/ URIs containing file.Path parameters. Any hits in those logs before the patch was applied are worth investigating as potential exploitation attempts.

Because successful exploitation can expose sensitive server-side files, organizations with vulnerable internet-accessible instances should also evaluate whether credentials or secrets accessible to the GitLab process require rotation. 

Single-node GitLab instances will experience downtime during the upgrade because database migrations must complete before GitLab can start, while multi-node instances can apply the patch without downtime by following proper zero-downtime upgrade procedures. Version 19.3.2 also includes post-deploy migrations that run after the upgrade completes.

The vulnerability was discovered by a researcher using the handle 's3ntago' and reported through GitLab's HackerOne bug bounty program. No attribution for CVE-2026-87719 or CVE-2026-88765 has been publicly confirmed at this time.

Read more »
Websites
Cloud Domain Internet malware Scams Websites

Attackers Use Expired Websites for Malware Scams


Dead websites may seem harmless once they are abandoned by their owners, but their old internet reputation can make them important tools for threat actors. A new research by Infoblox Threat Intel has revealed that threat actors are spending millions of dollars buying expired domain names and misusing them for online gambling, malware, scams, and illegal streaming.

Infoblox discovered that around 65,000 earlier previously registered domains are re-registered everyday, showing around one in five newly found domains,

What makes dead domains valuable

When a domain is dead, the history does not vanish immediately. The domain may still consist of traffic, backlinks, search-engine visibility, and an image built when it was in legitimate use previously.

Attackers can buy these domains and exploit the existing digital footprint. This can make a malicious infrastructure less dangerous than an entirely new domain. 

The tactic is usually called “dropcatchin”. Instead of making new sites from scratch, threat actors buy domains that have already created some level of visibility and trust.

Sable Squirrel behind the campaign

One of the largest campaigns detected by Infoblox is an attacker called Sable Squirrel. According to experts, the group has control over 10,000 domains and believe that it has invested over $7 million buying expired domains. 

“This actor has spent years turning other people’s domain history into its own criminal infrastructure, then using that infrastructure to run illegal sports streaming, online gambling promotion, and malware command-and-control (C2) side by side,” Infoblox said. 

Majority of the domains support a large gambling operation and sports streaming aimed mostly at Asian users, But experts found that some of the same infrastructure was utilised for command and control (C2) operations. 

Infoblox found over 31000 malware samples interacting with Sable Squirrel infrastructure such as njRAT, Remcos, NanoCore, DCRat, AsnycRAT, and Quasar RAT additionally with samples linked to HiddenTear ransomware. Experts confirmed 405 domains being exploited as malware command-and-control infrastructure. 

A larger cybercrime picture

Sable Squirrel was not the only group using dead domains, Infoblox also detected groups such as Swiping Squirrel, Shady Squirrel and Stuffy Squirrel. Some groups buy domains previously associated with malicious activity and exploit the existing traffic to redirect targets towards malware, advertising fraud, or scams.

Sable Squirrel’s main business is gambling, but it masks it as a streaming operation, while also doubling as an acquisition channel for the same.

“In Sable Squirrel’s hands, the domain becomes more than an address. It is the unit of trust, the traffic source, the brand surface, the routing layer, and, in some cases, the control channel,” said Infoblox.

Read more »
Mobile Security
Android Security Early Access Deceptive apps Google Play Mobile Security

Google Play Early Access Exploited for Fake Reward Apps

 

Cybersecurity firm Bitdefender has unearthed a large-scale exploit of Google Play’s Early Access program, where attackers are distributing thousands of deceptive Android apps that promise rewards, casino winnings, and premium content—but deliver relentless ads and data harvesting instead. By exploiting a key limitation of Early Access—disabled public ratings and reviews—malicious developers can avoid community warnings and scrutiny while aggressively promoting their apps through social media.

Modus operandi 

Google designed Early Access to help developers gather feedback on unfinished apps before full release, intentionally disabling public star ratings and user reviews to protect beta testers’ input from skewing an app’s reputation. However, Bitdefender’s investigation shows that bad actors are weaponizing this blind spot: without visible reviews, users cannot see red flags such as non-paying “reward” apps, fake casino games, or utilities requesting excessive permissions. The result is an ecosystem where deceptive apps can accumulate significant downloads before any public accountability kicks in. 

Researchers analysis of apps installed by its users identified thousands of suspicious Early Access listings across multiple categories, including fake casino and slot games, “earn money” and reward apps, PDF readers, QR scanners, phone trackers, and utility tools. Many of these apps are promoted via TikTok, Facebook, and other platforms using misleading ads, some featuring AI-generated deepfakes of celebrities to lend false credibility. 

After installation, users typically never receive promised payouts; instead, the apps serve persistent ad after ad, turning victims into a revenue stream for the operators through fraudulent ad impressions. Some apps also request unusual permissions or exhibit behavior that could pose serious security risks on corporate or personal devices. 

Beyond ad fraud, the researchers found Early Access listings that appear to infringe third-party trademarks, including imitation titles capitalizing on popular games and brands. The Early Access status also lets operators sidestep stricter rules that apply to real-money gambling apps, such as licensing requirements, geofencing, and age verification, by presenting themselves as unfinished or non-gambling products. This combination of weak oversight, hidden reviews, and external promotion creates a high-reward, low-risk channel for deceptive developers. 

Safety recommendations 

For users, the safest approach is to treat Early Access apps with extra caution, especially those promising cash, crypto, gift cards, or jackpots, and to avoid installing apps pushed via sensational social media ads. Organizations should consider blocking or flagging Early Access apps on managed Android devices, given the elevated risk of ad fraud, data harvesting, and permission abuse. On the platform side, Bitdefender’s findings highlight the need for Google to introduce stronger signals—such as limited or moderated user feedback, clearer labeling, and tighter review of high-risk categories—even within Early Access, to prevent the program from becoming a safe haven for deceptive apps.
Read more »
switch
Cyber Security Data Theft Nintendo qr code switch

Nintendo Switch Security Flaw Lets Nearby Attackers Exploit QR Codes Used to Share Screenshots

 



Nintendo has issued an urgent security advisory for owners of the original Switch console, warning of a flaw that could allow an attacker in close physical proximity to run unauthorized code on the device or pull data stored on it, simply by scanning a QR code displayed on the screen.

The vulnerability, catalogued as CVE-2026-82079, sits inside the console's local wireless networking stack and is classified as a stack-based buffer overflow, a type of memory corruption flaw in which a program writes more data into a fixed-length block of memory than it can hold. According to the technical record logged on OpenCVE, an attacker within wireless range can send specially crafted network packets that overflow this buffer and hijack the execution path of the device using a technique called return-oriented programming, which chains together fragments of existing code to carry out malicious instructions.

The bug affects all Nintendo Switch consoles running firmware earlier than version 23.0.0. The Switch 2 is not affected.


Where the QR code comes in

The attack is not theoretical in isolation, but it does require a specific scenario to work. The vulnerability surfaces when the console generates a QR code as part of its "Send to Smartphone" feature inside the Album application, which players use to transfer screenshots and video clips to a mobile device. It also appears when the local wireless function is active during a session of Mario Kart Live: Home Circuit, a game that pairs a real-world physical kart with the console.

In both cases, a QR code is briefly displayed on the Switch screen or the connected TV. Nintendo's advisory states that an attacker would need to physically scan that code while it is visible. If they manage to do so, the console becomes vulnerable to arbitrary code execution or information disclosure.

Nintendo said it has no evidence the flaw has been exploited in the wild as of September 10. The company also did not say that the vulnerability could be used to steal Nintendo account credentials, though it acknowledged that more serious exploits could theoretically be built on top of it.


Update now, or take these precautions

The fix is straightforward: install system update 23.0.0. Consoles connected to the internet will pull the update automatically, but players should verify the installation has completed in the console's System Settings under System and then System Update.

For players who cannot update immediately, Nintendo recommends keeping QR codes out of sight during photo and video sharing sessions. The company also advises against using another person's smartphone when transferring media, and against letting anyone else use their kart during a Mario Kart Live: Home Circuit session, since either scenario could create an opportunity for an attacker to scan the code.


How exposed is the player base

The scope of this issue is substantial purely because of how many original Switch units are in circulation. The original Switch has shipped over 155.92 million lifetime units as of March 31, 2026, making it one of the best-selling consoles ever made. Even with the Switch 2 now in the market, tens of millions of households around the world are still running the original hardware day to day. 

Nintendo said the flaw was discovered and reported by external security researchers, though it did not name them in its advisory, which was published on September 10.

The practical risk of this exploit being triggered in a real-world attack is relatively narrow. An attacker would need to be physically close to the device, see the QR code on screen, and scan it within the brief window it is displayed. That is a more demanding set of conditions than most software vulnerabilities require. But the potential consequence, unauthorized code execution on the console, is serious enough that Nintendo moved quickly to patch it, and players should move just as quickly to install that patch.

Read more »
Hacker attack
Backdoor Attacks backdoor vulnerability China Hackers Cyber Attacks cybersecurity research Gen Digital Hacker attack

China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

 

China-linked hackers took advantage of a vulnerability within Sogou Input Method, a widely used typing utility for Chinese characters on Windows, and managed to implant a backdoor onto their victims' computers, security company Gen Digital stated in research published Thursday. 

An initial crafted link would kick off the chain of events, giving the attackers end-to-end access to perform anything the logged in user would have access to. Tencent, which both owns and is developing Sogou, has alreadypatched the vulnerability in April 2026. The vulnerability was uncovered by Gen as they tracked a live ongoing breach by a group known as UNC3569, a China based hacker-for-hire. The group has been tracked since 2021 by Google Threat Intelligence to government, academic, technology, and financial targets, predominantly in Eastern and Southeast Asia. 

The planted backdoor (GRAYRABBIT), is a small program the group has been using for many years. As the first stage of gaining access to a machine, it is used to create a command shell remotely from the attacker, allowing for the uploading and downloading of files. More modules from the attacker's server could also be added into a system at any point via this command-line interface. Research produced in 2023 by Citizen Lab suggests that Sogou Input Method boasts over 455,000,000 monthly users on Windows, Android, and iOS respectively, and has captured approximately 70% of the Chinese input-method market. 

On Windows, this application functions by having several components send messages between one another utilizing its own custom link type, sgbiz:. Gen discovered that the program intended to process these links had an error. It failed to correctly screen command-line arguments from the user, meaning attackers can order Sogou's settings program to instead launch its skin store functionality, but directing it towards the attacker controlled website instead- the only functioning part of the application that opens the browsing window without checking which site you are visiting. 

This browser is already outdated; embedded within the Sogou package is version 80 of Chromium from March 2020. Neither the sandbox protection, nor the same-origin policy in this Chromium build were disabled in the codebase. This allowed a vulnerability released within the Java Script Engine in October 2021 (CVE-2021-38003, fixed in Chrome 95 October that year) to be taken advantage of once more by Chinese hackers. The exploit sends a downloader which can then fetch a few files from an Alibaba Cloud server situated in Hong Kong. 

One file was a DLL designed to spoof and hide inside a pirated copy of 7-Zip. Running processes would be scrutinized for analysis methods in a sandboxed environment prior to deployment of the GRAYRABBIT, which sends out requests for and receives information from a command server, encrypted by RC4 over port 443. Gen alerted Tencent on April 9 th 2026 (the vulnerability has been noted under the designation CVE-2026-51990), and Tencent provided a fix within twelve days in version 16.3.0.3498 (released April 21 st). 

It should be noted that the vulnerability present with the old Chromium build and compromised securities does not appear to have been amended. Users are instructed to update their version of Sogou Input Method without delay, and maintain an eye on the indicators of compromise on publication, which includes the malicious DLL, backdoor files, and applicable command and control websites.
Read more »
Subscribe to: Posts (Atom)

Featured