Solomon Yaoh

PENETRATION TESTER || THREAT INTELLIGENCE & RED TEAMING ||YOUNG CISO || Python || Sport lover

[Solomon Yaoh @t_yaoh]

Unveiling the Dark Side of Technology: The Menace of Phone Cloning and Sim Swapping https://t.co/b6h0arbEcE

[The Hacker News @TheHackersNews]

🚨 Bought a tent online? Meta now wants to know.

Starting next month, Meta will use what you do on other websites, like your purchases and games, to shape your Feed and AI chatbot replies, not just your ads.

It says you can opt out. Most people won't know how.

Read more about this here: https://t.co/0KmhaK6GGi

[Solomon Yaoh @t_yaoh]

The hardest breaches to stomach are the preventable ones.
Imagine: your security team finds the flaw, sounds the alarm, but the patch stalls in approvals. Weeks later, attackers exploit it. This isn’t a tech failure. There is more

Listen here 👇🏾

[Dr Joseph Ikhalia @RealCyberDoctor]

The Real Cyber Doctor Briefing is now live on Spotify.

Episode 1 explores why cybersecurity is becoming a leadership judgement problem, and why many organisations struggle not because risk is invisible, but because visible risk does not always lead to timely decisions.

Listen here:
https://t.co/igjqCVJcmI

[The Hacker News @TheHackersNews]

🛑 Google and YouTube ads are delivering FlutterShell, a new #macOS backdoor that passed Apple notarization with valid Developer IDs.

The malware can hijack Chrome traffic, run shell commands, alter files, and update its behavior from attacker servers.

Read: https://t.co/ELUmQYd4n8

[The Hacker News @TheHackersNews]

🚨 A one-click flaw in https://t.co/o6edbACPL3 can let attackers steal #GitHub OAuth tokens with read/write access to repositories, including private ones.

Microsoft is working on a fix.

The attack abuses VS Code webviews and local workspace extensions to extract tokens. VS Code Desktop is not affected.

Read: https://t.co/RkkZVl4FyU

[The Hacker News @TheHackersNews]

🤖 An autonomous AI tool found a Redis RCE vulnerability that went unnoticed for more than two years.

CVE-2026-23479 can let an authenticated user execute OS commands on the server. The flaw was introduced in Redis 7.2.0 and affected every stable branch until patches were released on May 5.

🔧 Details: https://t.co/U2nK6I9Zl0

[The Hacker News @TheHackersNews]

Many organizations invest in EDR but still lack real resilience. Lean teams drown in alerts, investigations lag, and responses are slow.

AI attacks are rising (67% of organizations affected), and 84% of major incidents now use living-off-the-land techniques.

Visibility alone isn’t enough.

Bitdefender GravityZone PHASR reduces attacker opportunities, while MDR adds 24x7 expert response.

Read: https://t.co/Z2ZajjJhjd

[The Hacker News @TheHackersNews]

⚠️ Russian hackers Gamaredon are quietly exploiting a WinRAR flaw to drop sophisticated malware on Ukrainian targets.

One infection chain turns a simple RAR file into GammaWorm — a stealthy self-spreading threat — and GammaSteel, a data thief.

Details: https://t.co/1eOqZnakBp

[The Hacker News @TheHackersNews]

🚨 An actively exploited #Oracle WebLogic Server flaw has been added to CISA's KEV catalog.

CVE-2024-21182 (CVSS 7.5) allows unauthenticated attackers with network access to compromise vulnerable servers and access critical data.

Federal agencies must patch by June 4, 2026.

Details: https://t.co/BqCGuHlQF0

[The Hacker News @TheHackersNews]

⚡AI is making DDoS attacks faster and smarter — helping attackers find weak spots, create new attack vectors, and scale attacks more efficiently.

Watch this WEBINAR to see how it works → https://t.co/nHBp5EAu5i

What you’ll get:
• Real examples of today’s AI-enhanced attacks
• How to find & fix hidden weaknesses fast
• Practical defenses you can apply immediately

[Dr Joseph Ikhalia @RealCyberDoctor]

Automation does not remove responsibility.

It concentrates consequence.

[The Hacker News @TheHackersNews]

🚨 AI chatbots are pushing cryptojacking malware.

Read → https://t.co/l4XNefx6OX

Attackers poisoned AI software recommendations to redirect users searching for tools like CrystalDiskInfo and HWMonitor to malicious download sites distributing ScreenConnect, rogue DLLs, and GPU mining malware.

More than 150 malicious domains were identified.

[The Hacker News @TheHackersNews]

⚠️ WARNING - A malicious npm package was caught stealing files from Claude AI users’ /mnt/user-data directories and uploading them to attacker-controlled GitHub repositories.

Check your installed packages: https://t.co/Ev9AKDSria

The package, “mouse5212-super-formatter,” used npm postinstall scripts, hard-coded GitHub tokens, and fake network logs to hide the theft.

Downloaded 676 times so far.

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: New Linux zero-day "Dirty Frag" lets ANY local user become root on most major distros.

The PoC is already public, half of it isn't patched yet.

Discovered by researcher Hyunwoo Kim, the exploit chains two kernel bugs and sits in the same family as Dirty Pipe and Copy Fail.

▪️ CVE-2026-43284 (xfrm-ESP Page-Cache Write): patched in mainline Linux.
▪️ CVE-2026-43500 (RxRPC Page-Cache Write): NO PATCH yet.

The exploit is reliable by design. Attackers don't have to win a timing race, the system won't crash and alert anyone if it fails, and it succeeds nearly every run.

The embargo got broken before distros could ship fixes, so the working code is now sitting on GitHub.

Confirmed working on: Ubuntu 24.04.4, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, Fedora 44.

[NITDA Nigeria @NITDANigeria]

🚨 CRITICAL CYBERSECURITY ALERT: DeepLoad AI Malware Targeting Nigerian Organisation

A new AI-powered malware called DeepLoad is actively targeting Nigerian government agencies, banks, businesses, and individuals.

[The Hacker News @TheHackersNews]

🚨 84% of cyberattacks now blend in using legitimate tools, not malware, across 700,000 incidents, according to Bitdefender’s Cristian Iordache.

Up to 95% of access to risky tools is unnecessary, quietly expanding attack surfaces.

See how this shifts security risk: https://t.co/HgtMxm1Qvf

[International Cyber Digest @IntCyberDigest]

‼️🚨 Microsoft calls this "intended behaviour," so here we go.

How to dump the credentials of every user stored in Microsoft Edge:

1. Open Edge. Don't browse anywhere, just open it.
2. Flip to Task Manager, find Edge, expand the task.
3. Highlight the "browser" sub-task, right-click, and choose "Create Memory Dump."
4. Open the dump file and look for credentials.

The logged-in Windows user can dump every stored Edge credential with no additional rights. Which means any malware that user executes has those credentials for the asking.

Thanks to Rob VandenBrink at SANS: https://t.co/ebtVZxne4L

[International Cyber Digest @IntCyberDigest]

❗️ Apple accidentally shipped Claude[.]md files in the Apple Support app update (v5.13).

For context, Claude[.]md is the instruction file Anthropic's Claude Code uses to understand a project's structure, conventions, and developer guidance. They typically live in source repos and are not meant to ship inside production apps.

Source: @aaronp613

[vx-underground @vxunderground]

One of the most frequent questions I'm asked is "how do you stay up to date on malware stuff?"

Okay, here is a pro tip:

1. Google OTX AlienVault
2. Make account
3. Look at latest
4. Scroll until you find posts from a guy named Petr something-something (has numbers in his name).
4. Follow his account

He monitors all the big malware places and shares the URL, hashes, etc. from malware vendors. I've been following this random ass dude for years and getting updates on everything.

I have no idea who he is. I don't know where he's from. All I know is his setup is absolute fire and he keeps you up to date on literally everything malware related 24/7 365. He also has stuff from vendors in China, Russia, Japan, etc.

Every morning I log into OTX and check up on my boy Petr to see what fire he's bringing me. I love him.

[Solomon Yaoh @t_yaoh]

There has been more vulnerabilities (Zero-days) disclosed without a patch since AI's first discovery.

I wonder how many are yet to be disclosed or are actively exploited.

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: An AI found a Linux kernel zero-day that roots every distribution since 2017. The exploit fits in 732 bytes of Python. Patch your kernel ASAP.

The vulnerability is CVE-2026-31431, nicknamed "Copy Fail," disclosed today by Theori. It has been sitting quietly in the Linux kernel for nine years.

Most Linux privilege-escalation bugs are picky. They need a precise timing window (a "race"), or specific kernel addresses leaked from somewhere, or careful tuning per distribution. Copy Fail needs none of that. It is a straight-line logic mistake that works on the first try, every time, on every mainstream Linux box.

The attacker just needs a normal user account on the machine. From there, the script asks the kernel to do some encryption work, abuses how that work is wired up, and ends up writing 4 bytes into a memory area called the "page cache" (Linux's high-speed copy of files in RAM). Those 4 bytes can be aimed at any program the system trusts, like /usr/bin/su, the shortcut to becoming root.

Result: the next time anyone runs that program, it lets the attacker in as root.

What should worry most: the corruption never touches the file on disk. It only exists in Linux's in-memory copy of that file. If you imaged the hard drive afterwards, the on-disk file would match the official package hash exactly. Reboot the machine, or just put it under memory pressure (any normal system load that needs the RAM), and the cached copy reloads fresh from disk.

Containers do not help either. The page cache is shared across the whole host, so a process inside a container can use this bug to compromise the underlying server and reach into other tenants.

The original sin was a 2017 "in-place optimization" in a kernel crypto module called algif_aead. It was meant to make encryption slightly faster. The change broke a critical safety assumption, and nobody noticed for nine years. That bug then rode every kernel update from 2017 to today.

This vulnerability affects the following:
🔴 Shared servers (dev boxes, jump hosts, build servers): any user becomes root
🔴 Kubernetes and container clusters: one compromised pod escapes to the host
🔴 CI runners (GitHub Actions, GitLab, Jenkins): a malicious pull request becomes root on the runner
🔴 Cloud platforms running user code (notebooks, agent sandboxes, serverless functions): a tenant becomes host root

Timeline:
🔴 March 23, 2026: reported to the Linux kernel security team
🔴 April 1: patch committed to mainline (commit a664bf3d603d)
🔴 April 22: CVE assigned
🔴 April 29: public disclosure

Mitigation: update your kernel to a build that includes mainline commit a664bf3d603d. If you cannot patch immediately, turn off the vulnerable module:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

For environments that run untrusted code (containers, sandboxes, CI runners), block access to the kernel's AF_ALG crypto interface entirely, even after patching. Almost nothing legitimate needs it, and blocking it shuts the door on this whole class of bug...

[The Hacker News @TheHackersNews]

🛑 26 fake wallet apps on Apple’s App Store stole recovery phrases and private keys.

They mimicked MetaMask and Coinbase, worked via China-region accounts, and used phishing, OCR, or injected code to capture seed phrases.

🔗 Read → https://t.co/1NNoekTqhK