🚨 Microsoft warns two Defender vulnerabilities are being actively exploited in the wild.
https://t.co/z92odj1gF0
🔸 CVE-2026-41091 could allow attackers to gain SYSTEM privileges locally.
🔸 CVE-2026-45498 is a denial-of-service flaw impacting Defender.
CISA added both to KEV with a June 3, 2026 patch deadline.
Aku jujurnya tak terkejut dengan berita ini
Sebab Teknologi Pegasus Israel memang antara teknologi godaman dan ISR tercanggih di dunia
Benda ini digunakan Unit 8200 dan Mossad untuk mengesan data pengguna
Dan membunuh mangsanya
🚨 Ransomware Alert 🚨
The Gentlemen ransomware group has added 15 new victims to their dark web portal.
* Icelandic Farmers' Association 🇮🇸
* La Kaffa International CO.,Ltd 🇹🇼
* DIGIPLEX SRL 🇮🇹
* Marutake Co., Ltd. 🇯🇵
* Kasapreko PLC 🇬🇭
* Levante Living 🇨🇦
* Ontario Physiotherapy Association 🇨🇦
* Millennium Partners 🇺🇸
* East Inc🇯🇵
* Modern Flour Mills🇯🇴
* Engineered Advantage 🇺🇸
* TRIQUIM 🇦🇷
* Keretapi Tanah Melayu Berhad 🇲🇾
* Mediatip srl 🇮🇹
* Arçelik Türkiye 🇹🇷
🇲🇾 A threat actor claims to have leaked a database allegedly with UOB (Malaysia).
The post includes a minimal sample referencing:
• Bank name
• Account numbers
• Timestamp fields (“first_seen”)
⚠️ Initial assessment:
• Claim is unverified
• Sample is extremely limited and lacks context
• No indication of:
– Customer identity data
– Transaction records
– Full dataset structure
This raises the possibility of:
• Synthetic or test data
• Aggregated/previously exposed information
• Misrepresented or low-value dataset
No evidence currently suggests a confirmed breach of UOB systems.
Potential risks (if validated):
• Financial fraud targeting account holders
• Social engineering using banking references
• Phishing campaigns impersonating UOB
🔐 Recommended precautions:
• Monitor bank accounts for unusual activity
• Do not share OTPs or banking credentials
• Verify any communication claiming to be from UOB
• Enable all available banking security controls
Current status: Unverified / low-confidence claim
#DDW #Intelligence #Malaysia #UOB #DataLeak #CyberSecurit
‼️ CVE-2026-41940: A high-performance, multi-threaded security auditing tool designed to detect CVE-2026-41940, a critical Authentication Bypass vulnerability in cPanel & WHM.
https://t.co/N5bKlx0vZK
🇲🇾 A threat actor on a cybercrime forum is claiming to have leaked data allegedly with OCBC Malaysia.
According to the forum post, the shared sample suggests the alleged dataset may include:
• Phone numbers
• Email addresses
• Banking-related information
• Passport-related fields
• National ID numbers (e.g., MyKad)
• Business registration data
• Driving license information
The post includes sample structured data and references to OCBC Malaysia domains. However, the authenticity, source, and scope of the alleged data remain unverified at this time.
No official statement from OCBC Malaysia has been observed regarding these claims.
If confirmed, exposure of financial and identity-related data could significantly increase the risk of:
• Financial fraud and account takeover
• Identity theft
• Targeted phishing and social engineering
• SIM-swapping attacks
Users and organizations are advised to:
• Monitor financial accounts for suspicious activity
• Enable MFA across banking and sensitive services
• Be cautious of unsolicited communications referencing OCBC
• Avoid sharing sensitive information via email or phone
#DDW #Intelligence #Malaysia #OCBC #CyberSecurity #DataBreach #DarkWeb
🐞 Nessus Agent Vulnerability on Windows Enables Arbitrary Code Execution
Source: https://t.co/6gnqn918jC
A newly disclosed security vulnerability in Tenable's Nessus Agent for Windows could allow attackers to execute malicious code with the highest level of system privileges, raising serious concerns for enterprise security teams relying on the widely-deployed vulnerability assessment platform.
The flaw enables a threat actor to create a Windows junction, a type of filesystem symbolic link that can be leveraged to delete arbitrary files with SYSTEM-level privileges.
Once file deletion at that privilege tier is achieved, the condition can cascade into a full arbitrary code execution scenario, effectively granting an attacker complete control over the affected machine.
#cybersecuritynews
🧠 AI-Powered Red Team — 28 Specialized Agents for Offensive Security 🤖🔥
Turn Claude into a full pentesting team.
• 28 agents (Recon, AD, Web, Cloud, Mobile)
• Auto task routing → correct agent
• Real tools support (nmap, sqlmap, nuclei, BloodHound)
• Recon → Exploit → Report
https://t.co/DvJVKM2hY9
#AI #RedTeam #Pentesting #CyberSecurity #Infosec
DeepZero: Find Zero-Days While You Sleep with an Automated Kernel Driver Exploit Hunting Engine ⚙️💀
Parses → Decompiles → Scans → Ranks → LLM Analysis
Targets thousands of Windows drivers to uncover exploitable IOCTLs and hidden attack surfaces — fully automated pipeline with YAML.
Ghidra + Semgrep + LLMs + parallel execution + resumable state
Built for real vulnerability research, not surface-level scanning.
https://t.co/9YImng1JDb
#ZeroDay #VulnResearch #AppSec #ReverseEngineering #RedTeam #CyberSecurity
Goodbye Claude Code subscription fees.
Someone just built a proxy that runs Claude Code completely free... and it's wild.
You literally plug in a free NVIDIA API key and point Claude Code at localhost.
That's it.
It handles everything:
- Converts Anthropic API calls to NVIDIA NIM format
- Unlocks 40 requests/min for free
- Supports Kimi K2, GLM 4.7, MiniMax M2, Devstral and more
- Streams thinking tokens and tool calls live
- Even includes a Telegram bot so you can run Claude Code from your phone
No API bill. No rate limit panic. No vendor lock-in.
Honestly, this goes beyond router tools like OpenRouter.
It doesn't just swap the model... it turns Claude Code into a free agent you can control remotely.
The project is open-source on GitHub.
It's called free-claude-code.
⚠️ Unauthorized Group Gains Access to Anthropic's Exclusive Cyber Tool Mythos
Source: https://t.co/akzEU9Xvwa
A group of unauthorized users has reportedly breached access controls surrounding Claude Mythos Preview, Anthropic's powerful and closely guarded AI-driven cybersecurity tool, raising serious concerns about third-party vendor security and the risks of placing advanced offensive AI capabilities in the wrong hands.
The model, deployed under Anthropic's Project Glasswing initiative, is capable of discovering zero-day vulnerabilities across major operating systems and web browsers, chaining software bugs into multi-step exploits, a feat previously achievable only by the most skilled human hackers.
#cybersecuritynews #Anthropic
🚨 BREAKING: Someone just built a web-based System Design Simulator.
It's called Paperdraw. It lets you drag and drop components to see how they handle real-world conditions like traffic, failures, latency, and scaling in real time.
100% free to try.
🛡️ Hackers Actively Attacking Adobe Reader Users Using Sophisticated 0-Day Exploit
Source: https://t.co/xcKBhENXN0
A highly sophisticated, unpatched zero-day exploit is actively targeting users of Adobe Reader.
Detected by the EXPMON threat-hunting system, this malicious PDF file is designed to steal sensitive local data and perform advanced system fingerprinting.
The exploit functions flawlessly on the latest version of Adobe Reader. It requires no user interaction beyond simply opening the malicious document.
The attack begins when a victim opens a specially crafted PDF, initially submitted to malware analysis platforms under the file name “yummy_adobe_exploit_uwu.pdf”.
#cybersecuritynews