TechLogHub Blog — Page 14 of 25
Insights, guides, and product strategy for builders and product teams.
Palo Alto Networks firewall zero-day exploited for nearly a month
Security researchers warn of a critical PAN-OS zero-day (CVE-2026-0300) in the User-ID Authentication Portal that has been exploited by suspected state-sponsored actors to achieve unauthenticated remote code execution on internet-facing PA-Series and VM-Series firewalls for nearly a month. Exploitation began around …
Fake Claude AI website delivers new 'Beagle' Windows malware
Security researchers warn of a fake Claude AI website that distributes a trojanized Claude-Pro Relay installer, delivering a Windows backdoor named Beagle. The campaign uses a bogus Claude-Pro-windows-x64.zip that drops NOVupdate.exe, NOVupdate.exe.dat, and avk.dll, loading DonutLoader and Beagle in memory to grant …
DAEMON Tools Devs Confirm Breach, Release Malware-Free Version
Disc Soft confirms a supply-chain attack that trojanized DAEMON Tools Lite installers, releasing a malware-free 12.6 version on May 5 while other DAEMON Tools products appear unaffected. Users who installed 12.5.1 since April 8 should uninstall, run a full scan, and upgrade to 12.6; prior activity linked by Kaspersk…
Why ransomware attacks succeed even when backups exist
Ransomware now often defeats backups by exposing, compromising, or destroying backup systems during an attack, not because backups are absent. This post outlines the typical attack chain and why traditional backup strategies fail—shared credentials, weak access controls, lack of immutable backups, untested recovery,…
Palo Alto Networks Warns of Firewall RCE Zero-Day Exploited in Attacks
Palo Alto Networks warns of a critical unpatched zero-day in the PAN-OS User-ID Authentication Portal (Captive Portal), tracked as CVE-2026-0300. The flaw, a buffer overflow, could allow unauthenticated attackers to execute code with root privileges on internet-facing PA-Series and VM-Series firewalls via crafted pa…
New stealthy Quasar Linux malware targets software developers
Trend Micro researchers have uncovered Quasar Linux (QLNX), a stealthy new Linux malware implant targeting software developers' environments (npm, PyPI, GitHub, AWS, Docker, Kubernetes) and signaling a potential supply-chain attack vector. QLNX combines rootkit, backdoor, and credential-stealing capabilities to achi…
Instructure Breach: Hacker Claims Data Theft From 8,800 Schools and Universities
Extortion group ShinyHunters claims to have stolen 280 million records from 8,809 schools and education platforms via Instructure's Canvas, exposing students’ and staff’s names, emails, and private messages; while some institutions confirm investigations, Instructure has not publicly commented and the scope of impac…
DAEMON Tools trojanized in supply-chain attack to deploy backdoor
Kaspersky reports a supply-chain attack that trojanized DAEMON Tools installers, delivering a backdoor to thousands of systems worldwide since April 8, 2026. The first-stage malware acts as an information stealer, while some victims received a second-stage payload—a lightweight backdoor capable of executing commands…
Student hacked Taiwan high-speed rail to trigger emergency brakes
Taiwanese university student arrested for hacking the Taiwan High-Speed Rail’s TETRA system by using software-defined radios and handheld radios to transmit a high-priority alarm, causing four THSR trains to halt for 48 minutes on April 5; an accomplice aided the plot; the 23-year-old faces up to 10 years’ imprisonm…
Vimeo data breach exposes personal information of 119,000 people
Vimeo confirms a breach linked to Anodot that exposed personal data for about 119,000 people—email addresses and, in some cases, names—along with technical data, video titles, and metadata. The company says no video content, valid user credentials, or payment card information were compromised, and there were no serv…
Google now offers up to $1.5 million for some Android exploits
Google is overhauling its Android and Chrome vulnerability rewards, offering up to $1.5 million for the hardest Android exploits (zero-click Pixel Titan M2 full-chain with persistence) and up to $750,000 without persistence, while Chrome rewards reach $250,000 plus a $250,128 bonus for MiraclePtr-protected memory. T…
Leaked AWS keys let phishers send through Amazon SES and pass SPF, DKIM and DMARC
Kaspersky saw phishing and BEC sent through hijacked Amazon SES accounts using IAM keys leaked in repos, .env files and images. How to lock down your keys.
Backdoored PyTorch Lightning package drops credential stealer
Security researchers disclosed a supply-chain attack in PyTorch Lightning: a compromised PyPI release (version 2.6.3) secretly downloads Bun and executes an obfuscated 11.4 MB JavaScript payload on import, delivering ShaiWorm, a credential-stealer that targets environment files, API keys, browser data, and cloud cre…
Trellix discloses data breach after source code repository hack
Trellix disclosed a data breach after unauthorized access to a portion of its source code repository and is investigating with external forensics, reporting no evidence yet that the source code or its distribution process was compromised and that law enforcement has been notified; further details will be shared afte…
They don’t hack, they borrow: How fraudsters target credit unions
Flare researchers reveal a structured loan-fraud technique that targets small to mid-sized credit unions by borrowing identities rather than hacking systems. Attackers assemble stolen personal data, KBA answers, and credit histories to pass identity verification and loan checks, then move funds out quickly through i…
Instructure Confirms Data Breach as ShinyHunters Claims Attack
Instructure confirms a cybersecurity incident affecting Canvas, with the ShinyHunters group claiming responsibility. The attackers say personal data from users at affected institutions—names, emails, student IDs, and messages—has been exposed. Instructure reports no current evidence of passwords, birth dates, govern…
Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha
Microsoft Defender flagged legitimate DigiCert root certificates as malware after a threat signature update on April 30, causing false positives and removals from the Windows trust store; two root certificates were reportedly affected, and Microsoft rolled out fixes in Security Intelligence updates (from 1.449.430.0…
Telegram Mini Apps Abused for Crypto Scams and Android Malware Delivery
Cybersecurity researchers have uncovered FEMITBOT, a Telegram-based fraud operation that uses Mini Apps and bots to run fake crypto platforms, impersonate brands (Apple, NVIDIA, Disney, eBay, IBM, Moon Pay, YouKu, and more), and deliver Android malware. The campaigns share a common backend, allow rapid branding/lang…
Critical cPanel flaw mass-exploited in "Sorry" ransomware attacks
A critical vulnerability in cPanel/WHM (CVE-2026-41940) is being mass-exploited in the Sorry ransomware campaign. An emergency update for WHM and cPanel has been released, but attackers have already compromised tens of thousands of servers—at least 44,000 IPs according to Shadowserver—and deployed a Go-based Linux e…
ConsentFix v3 Attacks Target Azure with Automated OAuth Abuse
Researchers warn of ConsentFix v3, a new automated OAuth abuse campaign targeting Microsoft Azure. The refinement verifies Azure tenants, gathers employee details for impersonation, and coordinates phishing and exfiltration across services (Outlook, Tutanota, Cloudflare, DocSend, Hunter.io, and Pipedream) to capture…
Showing 20 of 485 articles