Δ€ŁT4 TΞ¢H

Coffee lover / Geek / Spiritualist / Building things, breaking stuff. Sometimes they actually work.Just a simple human being. Sometimes feeling like an alien 👽

[The Hacker News @TheHackersNews]

‼️ A security patch wasn’t applied. Thousands of FBI employees had personal details stolen.

The FBI has now removed an Accenture contractor over the security failure tied to the ShinyHunters breach.

Read the full report → https://t.co/ZecZWYcd22

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: 320,000 Fortinet firewall devices have been targeted in a campaign that has been dubbed 'FortiBleed'. Attackers were able to confirm 75,000 working credentials against the admin and SSL VPN interfaces.

The victims include really big names like Samsung, Oracle, Spotify, Sony, and more.

The data was first surfaced by researcher Volodymyr "Bob" Diachenko and analyzed by Hudson Rock and SOCRadar. The operation runs as a self-feeding loop. Attackers scan the internet for exposed Fortinet devices, then test each one against a curated list of passwords leaked from earlier Fortinet breaches and infostealer logs. Every successful login gets recorded into a verified database. They then turn each compromised box into a listening post, sniffing the traffic passing through the firewall to harvest fresh credentials, which go straight back into the scanner.

The scale is large. The group ran an estimated 1.16 billion credential attempts against more than 320,000 FortiGate targets, plus 2.1 billion brute-force tries against 160,000 MSSQL servers. In the deeper intrusions they intercept SSL VPN authentication hashes, crack them on a dedicated 45-GPU cluster, and move into internal Active Directory.

Diachenko confirmed full network compromises in Japan, Taiwan, Vietnam, Iraq, and Turkey, including a Turkish NATO defense contractor that had classified defense documents stolen.

If you run Fortinet, act now: rotate every VPN and admin credential, enforce MFA on all external gateways, restrict management access to approved sources, segment internal networks, and audit gateway logs for unusual logins. Hudson Rock has a free domain lookup at https://t.co/KLv2YiMtpm.

Data surfaced via the Hunt Intelligence, Inc. feed.

[The Hacker News @TheHackersNews]

🚨 A backdoor once thought to target #Linux has now moved to Windows.

ESET found two Windows versions of SprySOCKS, linked to a China-nexus espionage group.

One version uses kernel drivers to hide files, processes, registry keys, and network connections.

Read ➝ https://t.co/0cItC4gcon

[BleepingComputer @BleepinComputer]

Windows version of SprySOCKS Linux malware used to attack govt orgs
https://t.co/Ao4nDNWzWl

https://t.co/Ao4nDNWzWl

[Cyber Security News @The_Cyber_News]

🚨 FortiBleed – 70,000+ Fortinet Firewalls Compromised in Massive Exploitation Attack

Source: https://t.co/lVtJOueGaF

An exhaustive cyber espionage campaign now dubbed "FortiBleed" has silently compromised over 73,932 unique Fortinet firewall URLs across 194 countries.

Threat actors executed an estimated 1.16 billion credential-based attempts against over 320,000 FortiGate targets, while simultaneously launching an additional 2.1 billion brute-force attempts against more than 160,000 MSSQL servers, resulting in 21,632 unique compromised domains.

This campaign is attributed to a multi-operator, Russian-speaking cybercriminal group whose methodology goes well beyond simple credential stuffing.

#cybersecuritynews

[IBTimes SG @IBTimesSG]

One compromised identity, Entire cloud systems exposed

@Microsoft revealed how a single hacked credential triggered a cascading breach across connected cloud environments, showing how modern cyberattacks no longer need massive entry points to cause massive damage.

Trust chains became the vulnerability
https://t.co/s6pKTJtHzj

Recent investigations into Microsoft-linked breaches continue highlighting how identity compromise and cloud trust relationships are becoming central attack vectors in large-scale cyber incidents.

[Dark Web Intelligence @DailyDarkWeb]

🇷🇸 A threat actor is claiming to possess a massive “72 million” record dataset allegedly linked to Serbian telecommunications providers, prominently referencing Telekom Srbija and multiple regional telecom operators.

The exposed fields shown in the listing allegedly include:
• Full names
• National ID/JMBG-related identifiers
• Addresses
• Mobile phone numbers
• Partner/customer IDs
• Installation/service details
• Device serial numbers
• Employee and distributor information
• Service package and infrastructure metadata

The post references several major Serbian telecom and ISP brands, including:
• Telekom Srbija
• Yettel Serbia
• CETIN Serbia
• A1 Serbia
• SBB
• Orion Telekom
• YUNET

At this stage, the authenticity, origin, and actual scale of the dataset remain unverified. The claimed volume appears unusually large relative to Serbia’s population, which may indicate:
• Aggregated multi-source telecom datasets
• Historical/internal infrastructure records
• Duplicated entries
• Scraped operational data
• Inflated claims for attention or resale value

If legitimate, the exposure could create significant risks:
• SIM swap targeting
• Telecom fraud
• Identity theft
• Social engineering campaigns
• Infrastructure reconnaissance
• Insider targeting
• Credential-reset abuse using subscriber information

Telecom providers and affected organizations should:
• Monitor for unusual account recovery activity
• Increase anti-SIM-swap protections
• Audit exposed internal operational systems
• Review third-party/vendor access
• Monitor dark web resale channels and credential markets
• Alert customers regarding phishing risks

No official confirmation regarding the alleged dataset has been publicly identified at this time.

#DDW #Intelligence #Serbia #Telecom #CyberSecurity #DarkWeb #DataBreach

[Cyber Security News @The_Cyber_News]

⚠️Hackers Actively Exploiting Critical NGINX RCE Vulnerability in the Wild

Source: https://t.co/7FVnJNpPPW

Hackers are wasting no time exploiting a newly disclosed critical vulnerability in NGINX, with security researchers already observing real-world attacks just days after its public release.

Threat actors are actively targeting CVE-2026-42945, a heap buffer overflow flaw affecting both NGINX Open Source and NGINX Plus. According to Censys data, around 5.7 million internet-facing NGINX servers could be running vulnerable versions.

#cybersecuritynews

[The Hacker News @TheHackersNews]

🛑 Ivanti, Fortinet, SAP, VMware and n8n released fixes for flaws tied to auth bypass, RCE, SQL injection and privilege escalation.

The patches include CVSS 9.6 bugs in Ivanti Xtraction and SAP, plus five n8n RCE flaws.

See what was fixed: https://t.co/sr9Xk1U12z

[BleepingComputer @BleepinComputer]

Alleged Silk Typhoon hacker extradited to US for cyberespionage
https://t.co/ci0Cuw3yNF

https://t.co/ci0Cuw3yNF

[Pirat_Nation 🔴 @Pirat_Nation]

Russian spies hacked several TP-Link routers in Latvia and thousands more worldwide.

They used a known weakness in older models to change the router’s settings, this let them spy on internet traffic from connected phones and computers, stealing passwords and other data.

In late March 2026, the FBI and Latvian security services worked together in Operation Masquerade and they remotely fixed the affected routers in Latvia to block further access.

To stay safe:

>Update your router’s software right away.
>Change the default admin password to a strong one.
>Replace any very old router that no longer gets updates.

Check with your internet provider or CERT(.)lv if you’re not sure.

[Nicolas Krassas @Dinosn]

OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years https://t.co/PtMUAsSbsF

[Cyber Security News @The_Cyber_News]

⚠️ Udemy Data Breach - ShinyHunters Claims Compromise of 1.4M User Records

Source: https://t.co/AFS9aFEkqt

The notorious cybercriminal group ShinyHunters has claimed responsibility for a major data breach targeting Udemy, Inc., one of the world's largest online learning platforms, and has alleged the compromise of over 1.4 million records containing personally identifiable information (PII) and internal corporate data.

The claim was first observed on April 24, 2026, when ShinyHunters posted a "Pay or Leak" warning on their data leak site, setting a final deadline of April 27, 2026, for Udemy to respond or face public exposure of the stolen data.

#cybersecuritynews #databreach

[Cyber Security News @The_Cyber_News]

⚠️ Windows RPC Vulnerability Lets Attackers Escalate Privileges Across All Windows Versions

Source: https://t.co/luN3UDOucJ

PhantomRPC, a newly identified architectural vulnerability in Windows Remote Procedure Call (RPC) that enables local privilege escalation to SYSTEM-level access, potentially affecting every version of Windows. PhantomRPC is not a classic memory corruption bug or a logic flaw in a single component.

Instead, it exploits an architectural design weakness in how the Windows RPC runtime (rpcrt4.dll) handles connections to unavailable RPC servers. When a highly privileged process attempts an RPC call to a server that is offline or disabled, the RPC runtime does not verify whether the responding server is legitimate.

#cybersecuritynews #Windows

[The Hacker News @TheHackersNews]

🔥 A U.S. federal agency was hacked via Cisco firewall.

Attackers used ASA flaws to install FIRESTARTER, a backdoor that stays even after patches and normal reboots.

Fix requires full reimage or hard power cycle, not just updating software.

🔗 Read → https://t.co/sbjyK90Fuy

[Cyber Security News @The_Cyber_News]

🔐 Hackers Can Abuse Entra Agent ID Admin Role to Hijack Service Principals

Source: https://t.co/ePEtkkkXAl

A critical scope overreach vulnerability was recently identified in the Microsoft Entra Agent Identity Platform. The newly introduced Agent ID Administrator role allowed accounts to hijack arbitrary service principals and escalate privileges across the entire tenant.

New research found that actions like updating agent identity owners allowed administrators to modify the ownership of any service principal in the tenant.

A user with the Agent ID Administrator role could assign themselves as the owner of a completely unrelated, high-privileged service principal.

#cybersecuritynews

[The Hacker News @TheHackersNews]

🛑 A fake PDF reader is being used to quietly take over systems.

Tropic Trooper spreads a trojanized app that runs AdaptixC2 via GitHub-based control, then uses Microsoft Visual Studio Code tunnels for access on high-value targets.

🔗 Read → https://t.co/kLsY5y8hOX

[Nicolas Krassas @Dinosn]

Cisco says hackers have been exploiting a critical bug to break into big customer networks since 2023 https://t.co/iLHqRjkrPJ

[The Cyber Security Hub™ @TheCyberSecHub]

Google Disrupts ‘Prolific’ and ‘Elusive’ China-Linked Global Hacking Campaign https://t.co/wnItonqP7h #cybersecurity #infosec #hacking

[The Hacker News @TheHackersNews]

🔥 OpenClaw now scans every ClawHub skill using 🛡️ VirusTotal threat intel.

Uploads are hashed, analyzed via Code Insight, then auto-approved, flagged, or blocked. Daily rescans 🔍 check if clean skills turn malicious later.

⚠️ Hundreds of risky skills had slipped through earlier.

🔗 Read → https://t.co/Ieo8WEiwNQ