FreshRSS

πŸ”’
❌ Secure Planet Training Courses Updated For 2019 - Click Here
☷
β–³ πŸ”ƒ
There are new available articles, click to refresh the page.
Today β€” January 28th 2026Your RSS feeds

Fake Moltbot AI Coding Assistant on VS Code Marketplace Drops Malware

By: Ravie Lakshmanan
Cybersecurity researchers have flagged a new malicious Microsoft Visual Studio Code (VS Code) extension for Moltbot (formerly Clawdbot) on the official Extension Marketplace that claims to be a free artificial intelligence (AI) coding assistant, but stealthily drops a malicious payload on compromised hosts. The extension, named "ClawdBot Agent - AI Coding Assistant" ("clawdbot.clawdbot-agent")

My favorite budget-friendly robot vacuum is from a brand you've never heard of

I test robot vacuums for a living, but one of the most pleasant surprises is from a $230 unit.

Limits of static guarantees under adaptive adversaries (G-CTR experience)

By: ／u／Obvious-Language4462

Sharing some practical experience evaluating G-CTR-like guarantees from a security perspective.

When adversaries adapt, several assumptions behind the guarantees degrade faster than expected. In particular:

- threat models get implicitly frozen

- test-time confidence doesn’t transfer to live systems

- some failures are invisible until exploited

Curious if others in netsec have seen similar gaps between formal assurance and operational reality.

submitted by /u/Obvious-Language4462
[link] [comments]

Fortinet unearths another critical bug as SSO accounts borked post-patch

More work for admins on the cards as they await a full dump of fixes

Things aren't over yet for Fortinet customers – the security shop has disclosed yet another critical FortiCloud SSO vulnerability.…

KDE Plasma 6.6 is almost here, and this Linux distro gave me an early look - here's how

If you're looking to see what's coming in KDE Plasma 6.6, your best bet is to give KDE Neon Unstable a try.

Russian ELECTRUM Tied to December 2025 Cyber Attack on Polish Power Grid

By: Ravie Lakshmanan
The "coordinated" cyber attack targeting multiple sites across the Polish power grid has been attributed with medium confidence to a Russian state-sponsored hacking crew known as ELECTRUM. Operational technology (OT) cybersecurity company Dragos, in a new intelligence brief published Tuesday, described the late December 2025 activity as the first major cyber attack targeting distributed energy

Fun RCE in Command & Conquer: Generals

By: ／u／jordan9001

So many of your favorite childhood games are open source now, and bugs fall out of them if you just glance in the right spots.

submitted by /u/jordan9001
[link] [comments]

Google's $8 AI Plus plan is here - should you switch from the $20 Pro?

Want more Gemini without paying for Pro? Google AI Plus might be for you. Here's what it includes.

Amazon is refunding nearly $1 billion to customers - are you eligible?

Amazon began issuing surprise refunds last year - in some cases for returns as old as 8 years and totaling more than $1,000.

Old Windows quirks help punch through new admin defenses

Google researcher sits on UAC bypass for ages, only for it to become valid with new security feature

Microsoft patched a bevy of bugs that allowed bypasses of Windows Administrator Protection before the feature was made available earlier this month.…

Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code Execution

By: Ravie Lakshmanan
A critical sandbox escape vulnerability has been disclosed in the popular vm2 Node.js library that, if successfully exploited, could allow attackers to run arbitrary code on the underlying operating system. The vulnerability, tracked as CVE-2026-22709, carries a CVSS score of 9.8 out of 10.0 on the CVSS scoring system. "In vm2 for version 3.10.0, Promise.prototype.then Promise.prototype.catch

Two High-Severity n8n Flaws Allow Authenticated Remote Code Execution

By: Ravie Lakshmanan
Cybersecurity researchers have disclosed two new security flaws in the n8n workflow automation platform, including a crucial vulnerability that could result in remote code execution. The weaknesses, discovered by the JFrog Security Research team, are listed below - CVE-2026-1470 (CVSS score: 9.9) - An eval injection vulnerability that could allow an authenticated user to bypass the Expression

From Triage to Threat Hunts: How AI Accelerates SecOps

By: Unknown
If you work in security operations, the concept of the AI SOC agent is likely familiar. Early narratives promised total autonomy. Vendors seized on the idea of the "Autonomous SOC" and suggested a future where algorithms replaced analysts. That future has not arrived. We have not seen mass layoffs or empty security operations centers. We have instead seen the emergence of a practical reality.

Mustang Panda Deploys Updated COOLCLIENT Backdoor in Government Cyber Attacks

By: Ravie Lakshmanan
Threat actors with ties to China have been observed using an updated version of a backdoor called COOLCLIENT in cyber espionage attacks in 2025 to facilitate comprehensive data theft from infected endpoints. The activity has been attributed to Mustang Panda (aka Earth Preta, Fireant, HoneyMyte, Polaris, and Twill Typhoon) with the intrusions primarily directed against government entities located

Password Reuse in Disguise: An Often-Missed Risky Workaround

By: Unknown
When security teams discuss credential-related risk, the focus typically falls on threats such as phishing, malware, or ransomware. These attack methods continue to evolve and rightly command attention. However, one of the most persistent and underestimated risks to organizational security remains far more ordinary. Near-identical password reuse continues to slip past security controls, often

The best home battery and backup systems of 2026: Expert tested for emergencies and more

We tested and researched the best home battery and backup systems from brands like EcoFlow and Tesla to help you find the right fit to keep you safe during outages or reduce your reliance on grid energy.

Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088

By: Ravie Lakshmanan
Google on Tuesday revealed that multiple threat actors, including nation-state adversaries and financially motivated groups, are exploiting a now-patched critical security flaw in RARLAB WinRAR to establish initial access and deploy a diverse array of payloads. "Discovered and patched in July 2025, government-backed threat actors linked to Russia and China as well as financially motivated

Fake Python Spellchecker Packages on PyPI Delivered Hidden Remote Access Trojan

By: Ravie Lakshmanan
Cybersecurity researchers have discovered two malicious packages in the Python Package Index (PyPI) repository that masquerade as spellcheckers but contain functionality to deliver a remote access trojan (RAT). The packages, named spellcheckerpy and spellcheckpy, are no longer available on PyPI, but not before they were collectively downloaded a little over 1,000 times. "Hidden inside the Basque

Drowning in spam or scam emails? Here’s probably why

Has your inbox recently been deluged with unwanted and even outright malicious messages? Here are 10 possible reasons – and how to stem the tide.

Blind Boolean-Based Prompt Injection

By: ／u／-rootcauz-

I had an idea for leaking a system prompt against a LLM powered classifying system that is constrained to give static responses. The attacker uses a prompt injection to update the response logic and signal true/false responses to attacker prompts. I haven't seen other research on this technique so I'm calling it blind boolean-based prompt injection (BBPI) unless anyone can share research that predates it. There is an accompanying GitHub link in the post if you want to experiment with it locally.

submitted by /u/-rootcauz-
[link] [comments]

[Research] Analysis of 74,636 AI Agent Interactions: 37.8% Contained Attack Attempts - New "Inter-Agent Attack" Category Emerges

By: ／u／cyberamyntas

We've been running inference-time threat detection across 38 production AI agent deployments. Here's what Week 3 of 2026 looked like with on-device detections.

Key Findings

  1. 28,194 threats detected across 74,636 interactions (37.8% attack rate)
  2. Inter-Agent Attacks emerged as a new category (3.4% of threats) - agents sending poisoned messages to other agents
  3. Data exfiltration leads at 19.2% - primarily targeting system prompts and RAG context
  4. Jailbreaks detected with 96.3% confidence - patterns are now well-established

Attack Technique Breakdown

  1. Instruction Override: 9.7%
  2. Tool/Command Injection: 8.2%
  3. RAG Poisoning: 8.1% (trending up)
  4. System Prompt Extraction: 7.7%

The inter-agent attack vector is particularly concerning given the MCP ecosystem growth. We're seeing goal hijacking, constraint removal, and recursive propagation attempts.

Full report with methodology: https://raxe.ai/threat-intelligence

Github: https://github.com/raxe-ai/raxe-ce is free for the community to use

Happy to answer questions about detection approaches

submitted by /u/cyberamyntas
[link] [comments]

Fortinet Patches CVE-2026-24858 After Active FortiOS SSO Exploitation Detected

By: Ravie Lakshmanan
Fortinet has begun releasing security updates to address a critical flaw impacting FortiOS that has come under active exploitation in the wild. The vulnerability, assigned the CVE identifier CVE-2026-24858 (CVSS score: 9.4), has been described as an authentication bypass related to FortiOS single sign-on (SSO). The flaw also affects FortiManager and FortiAnalyzer. The company said it's

Corrupting the Hive Mind: Persistence Through Forgotten Windows Internals

By: ／u／bouncyhat

Dropping a link to our blog post about our tool Swarmer, a windows persistence tool for abusing mandatory user profiles. Essentially you copy the current user's registry hive and modify it to add a new registry key to run on startup. Because the new hive isn't loaded until the next time the user logs in, EDR never sees any actual registry writes.

submitted by /u/bouncyhat
[link] [comments]

How McAfee’s Scam Detector Checks QR Codes and Social Messages

By: Brooke Seipel
QR Scan Example

ScamsΒ don’tΒ always arrive with obvious warning signs.Β 

They show up as QR codes on parking meters. As casual DMs that start with β€œHey.” As social messages that feel routine enough to respond to without thinking twice.Β 

That shift has created a new burden for consumers. According to McAfee’s 2026 State of theΒ ScamiverseΒ report,Β Americans now spend 114 hours a year trying to figure outΒ what’sΒ real andΒ what’sΒ fake online. That isΒ nearlyΒ threeΒ full workweeksΒ lost to second-guessing messages, alerts, links, and notifications.Β 

McAfee’s upgraded Scam Detector is designed to meet people in those exact moments, with enhancements rolling out across core McAfee plans beginning in February.Β 

The latest improvements add instant QR codeΒ scamΒ checks and smarter social messaging protection, making it easier to spotΒ scamsΒ before they escalate.Β 

Figure 1:Β An example of a suspicious text being flagged by McAfee’s Scam DetectorΒ 

Figure 1:Β An example of a suspicious text being flagged by McAfee’s Scam DetectorΒ 

What’sΒ new in McAfee’s Scam DetectorΒ 

ScamsΒ now move quickly across platforms and formats, often escalating in minutes once someone engages. Among people who were harmed by aΒ scam,Β the typicalΒ scamΒ unfolded in about 38 minutes.Β 

That speed leaves little room for hesitation.Β ScamΒ protectionΒ has toΒ work in real time, not after the damage is done.Β 

McAfee’s latest Scam Detector upgrades are designed around that reality, adding:Β 

  • Instant QR code safety checks, so users can assess risk before tappingΒ 
  • Smarter social messaging protection, with clearer warnings for suspicious texts, emails, and DMs, even when no link is presentΒ 

These Scam Detector upgrades will begin rolling out in February across all core McAfee plans, bringing real-time protection to the moments whereΒ scamsΒ escalate fastest.Β 

QR codes,Β quishing, and why instant scans are neededΒ 

QR codes were designed for convenience. That is exactly why scammers use them.Β 

Cybercriminals increasingly hide malicious links behind QR codes placed on menus, parking meters, packages, posters, and public signage. People scan quickly, often without stopping to evaluate where the code leads.Β 

McAfee research shows how common this risk has become:Β 

  • 68% of people scanned a QR code in the past three monthsΒ 
  • 18% landed on a suspicious or unsafe page after scanningΒ 
  • Among those who did, more than half took risky actions such as entering personal information, installing an app, or connecting a digital walletΒ 

QR Scan Example

Figure 2. A still from a demo video, showing a risky QR code being blocked by McAfee’s Scam DetectorΒ 

Social media scams and the rise of linkless messagesΒ 

Phishing is no longer confined to emails with obvious red flags.Β 

ScamsΒ now arrive through WhatsApp, Instagram, Messenger, Telegram, and other social platforms, often startingΒ asΒ vague or friendly messages designed to lower suspicion rather than trigger alarm.Β 

McAfee’s research highlights a key shift:Β more than one in four suspicious social messagesΒ containΒ no link at all, andΒ 44% of Americans say they have replied to a suspicious DM with no link.Β 

These messages rely on familiarity and momentum. A short greeting. A warning about an account issue. A promise of easy money. By the time a request or link appears, the conversation already feels normal.Β 

And the economic impact of theseΒ scamsΒ is significant. According to the FTC, social mediaΒ scamsΒ droveΒ $1.9 billion in reported losses in 2024, making social platforms one of the top channels for fraud and identity theft.Β 

That’sΒ why McAfee’s Scam Detector includes smarter social messaging protection,Β delivering clearer warnings for suspicious texts, emails, and DMs, even those without risky links, across popular platforms. The focus is onΒ identifyingΒ suspicious patterns and behavior, not just URLs.Β 

Users can take a quick screenshot of their social media content on social media, and McAfee’s Scam Detector will analyze the message for suspicious activity.Β 

Get protection that works beforeΒ scamsΒ escalateΒ 

The stakes are high:Β 

  • One in three AmericansΒ has lost money to aΒ scamΒ 
  • Among those who lost money, the average loss wasΒ $1,160Β 
  • 15%Β ofΒ scamΒ victims fall for anotherΒ scamΒ within a yearΒ 

ScamsΒ are not just increasing in volume. They are becoming more personal, more believable, and easier to scale using AI.Β 

McAfee’s upgraded Scam DetectorΒ isΒ designed to stay ahead of those shifts, offering real-time guidance when it matters most, whetherΒ that’sΒ a suspicious QR code, a vague DM, or a message that feelsΒ just normalΒ enough to trust.Β 

The enhanced Scam Detector, including instant QR code checks and smarter social messaging protection,Β will begin rolling out in February across all core McAfee plans.Β 

The post How McAfee’s Scam Detector Checks QR Codes and Social Messages appeared first on McAfee Blog.

McAfee Report: In the AI Slop Era, Americans Spend Weeks Each Year Questioning What’s Real

By: Brooke Seipel

Merriam-Webster’s word of 2025 was β€œslop.” Specifically, AI slop.Β 

Low-effort, AI-generated content now fills social feeds, inboxes, and message threads. Much of it is harmless. Some of it is entertaining. But its growing presence is changing what people expect to see online.

McAfee’s 2026 State of the Scamiverse report shows that scammers are increasingly using the same AI tools and techniques to make fraud feel familiar and convincing. Phishing sites look more legitimate. Messages sound more natural. Conversations unfold in ways that feel routine instead of suspicious.

According to McAfee’s consumer survey, Americans now spend an average of 114 hours a year trying to determine whether the messages they receive are real or scams. That’sΒ nearly three full workweeks lost not to fraud itself, but to hesitation and doubt.

As AI-generated content becomes more common, the traditional signals people relied on to spot scams, such as strange links and awkward grammar, are fading. That shift does not mean everything online is dangerous. It means it takes more effort to tell what is real from what is malicious.

The result is growing uncertainty. And a rising cost in time, attention, and confidence.

The average American receives 14 scam messages a dayΒ 

ScamsΒ are no longer occasional interruptions. They are a constant background noise.Β 

According to the report,Β Americans receive an average of 14Β scamΒ messages per dayΒ across text, email, and social media.Β Β 

Many of these messages do not lookΒ suspicious at first glance. They resemble routine interactions people are conditioned to respond to.Β 

  • Delivery noticesΒ 
  • Account verification requestsΒ 
  • Subscription renewalsΒ Β 
  • Job outreachΒ 
  • Bank alertsΒ 
  • Charity appealsΒ 

And with the use of AI tools, scammers are churning out these scam messages and making them look extremely realistic.

That strategy is working.Β One in three Americans says they feel less confident spotting scams than they did a year ago.Β Β 

Β 

scam statsFigure 1. Types of scams reported in our consumer survey.Β 

MostΒ scamsΒ move fast, and many are over in minutesΒ 

The popular image ofΒ scamsΒ often involves long email threads or elaborate schemes.Β In reality, manyΒ modernΒ scamsΒ unfold quickly.Β 

Among Americans who were harmed by aΒ scam,Β the typicalΒ scamΒ played out in about 38 minutes.Β Β 

That speed matters. It leaves little time for reflection, verification, or second opinions. Once a person engages, scammers often escalateΒ immediately.Β 

Still, some scammers play the long game with realistic romance or friendship scams that turn into crypto pitches or urgent requests for financial support. Often these scams start with no link at all, but just a familiar DM.

In fact, the report found that more than one in four suspicious social messagesΒ containΒ no link at all, removing one of the most familiar warning signs of a scam. Β And 44% of people say they have replied to a suspicious direct message without a link.Β Β 

Linkless DM scams seek to build trust before asking victims for money.

TheΒ costΒ is not just money. It is time and attention.Β 

Financial losses fromΒ scamsΒ remainΒ significant.Β One in three Americans report losing money to aΒ scam.Β Among those who lost money,Β the average loss was $1,160.Β Β 

But the report argues that focusing only on dollar amounts understates the broader impact: scams also cost time, attention, and emotional energy.Β 

People are forced to second-guess everyday digital interactions. Opening a message. Answering a call. Scanning a QR code. Responding to a notification. That time adds up.Β 

And who doesn’t know that sinking feeling when you realize a message you opened or a link you clicked wasn’t legitimate?

map of annual scam losses globally 2025

Figure 3. World Map of Average Scam Losses.Β 

Why AI slop makesΒ scamsΒ harder to spotΒ 

The rise of AI-generated content has changed the baseline of what people expect online. It’s now an everyday part of life.

According to the report,Β Americans say they see an average of three deepfakes per day.Β Β 

Most are notΒ scams. But that familiarity has consequences.Β 

When AI-generated content becomes normal, it becomes harder to recognize when the same tools are being used maliciously. The report found thatΒ more than one in three Americans do not feel confident identifying deepfakeΒ scams, andΒ one in ten say they have already experienced a voice-clone scam.Β Voice clone scams often feature AI deepfake audio of public figures, or even people you know, requesting urgent financial support and compromising information.

These AI-generated scams also come in the form of phony customer support outreach, fake job opportunities and interviews, and illegitimate investment pitches.

Account takeovers are becoming routineΒ 

ScamsΒ do not always end with an immediateΒ financial loss. Many are designed to gain long-term access to accounts.Β 

The report found thatΒ 55% of Americans say a social media account was compromised in the past year.Β Β 

Once an account is taken over, scammers can impersonate trusted contacts, spread malicious links, or harvestΒ additionalΒ personal information. The damage often extends well beyond the original interaction.Β 

What not to do in 2026ScamsΒ are blending into everyday digital lifeΒ 

What stands out most in the 2026 report is how thoroughlyΒ scamsΒ have blended into normal online routines.Β 

ScammersΒ areΒ embedding fraud into the same systems people rely on to work, communicate, and manage their lives.Β 

  • Cloud storage alerts (such as Google Drive or iCloud notices) warning that storage is full or access will be restricted unless action is taken, pushing users toward fake login pages.
  • Shared document notifications that appear to come from coworkers or collaborators, prompting recipients to open files or sign in to view a document that does not exist.
  • Payment confirmations that claim a charge has gone through, pressuring people to click or reply quickly to dispute a transaction they do not recognize.
  • Verification codes sent unexpectedly, often as part of account takeover attempts designed to trick people into sharing one-time passwords.
  • Customer support messages that impersonate trusted brands, offering help with an issue the recipient never reported.

Cloud scam Example

Figure 4: Example of a cloud scam message.Β 

The Key Takeaway

Not all AI-generated content is a scam. Much of what people encounter online every day is harmless, forgettable, or even entertaining. But the rapid growth of AI slop is creating a different kind of risk.

Constant exposure to synthetic images, videos, and messages is wearing down people’s ability to tell what is real and what is manipulated. The State of the Scamiverse report shows that consumers are already struggling with that distinction, and the data suggests the consequences are compounding. As digital noise increases, so does fatigue. And fatigue is exactly what scammers exploit.

FTC data shows losses from scams continuing to climb, and McAfee Labs is tracking a rise in fraud that blends seamlessly into everyday digital routines. Cloud storage warnings, shared document notifications, payment confirmations, verification codes, and customer support messages are increasingly being mimicked or abused by scammers because they look normal and demand quick action.

The danger of the AI slop era is not that everything online is fake. The danger is that people are being forced to question everything. That constant doubt slows judgment, erodes confidence, and creates openings for fraud to scale.

In 2026, the cost of scams is no longer measured only in dollars lost. It is measured in time, attention, and trust, and those losses are still growing.

Learn more and read the full report here.

FAQ: Understanding the AI Slop Era and Modern ScamsΒ 

Q: What is AI slop?Β Β 

A: The term refers to the flood of low-quality, AI-generated content now common online. While much of it is harmless, constant exposure can make it harder toΒ identifyΒ when similar technology is used forΒ scams.Β Β Β 
Q: How much time do Americans lose toΒ scams?Β Β 

A: Americans spendΒ 114 hours a yearΒ determiningΒ whether digital messages and alerts are real or fraudulent. That isΒ nearly threeΒ workweeks.Β Β Β 
Q: How fast doΒ scamsΒ happen today?Β Β 

A: Among people harmed byΒ scams, the typicalΒ scamΒ unfolds in aboutΒ 38 minutesΒ from first interaction to harm.Β Β Β 
Q: How common are deepfakeΒ scams?Β Β 

A: Americans report seeing three deepfakes per day on average, and one in ten say they have experienced a voice-cloneΒ scam.Β Β Β 

Β 

The post McAfee Report: In the AI Slop Era, Americans Spend Weeks Each Year Questioning What’s Real appeared first on McAfee Blog.

Yesterday β€” January 27th 2026Your RSS feeds

Need to manage virtual machines on Linux? I found an easier way

If you're looking for a way to manage virtual machines on Linux and even do it remotely, Cockpit is what you want.

Paranoid WhatsApp users rejoice: Encrypted app gets one-click privacy toggle

Meta also replaces a legacy C++ media-handling security library with Rust

Users of Meta's WhatsApp messenger looking to simplify the process of protecting themselves are in luck, as the company is rolling out a new feature that combines multiple security settings under a single, toggleable option. …

Move over, Claude: Moonshot's new AI model lets you vibe-code from a single video upload

While it's not yet clear how practically useful the capability will be for individuals and businesses, the model's "coding with vision" capability makes vibe coding even vibier.

The Alienware 16 Aurora is a powerhouse gaming laptop, and it's under $1,000 at Dell

In a world where $1,000 will barely cover a RAM or GPU upgrade, you can snag the premium Alienware 16 Aurora gaming laptop on sale for just under that.

Let them eat sourdough: ShinyHunters claims Panera Bread as stolen credentials victim

Plus, the gang says it got in via Microsoft Entra SSO

ShinyHunters says it stole several slices of data from Panera Bread, but that's just the yeast of everyone's problems. The extortionist gang also claims to have stolen data from CarMax and Edmunds, in addition to three other organizations it posted to its blog last week.…

Why code indexing matters for AI security tools

By: ／u／Same-Cauliflower-830

AI coding tools figured out that AST-level understanding isn't enough. Copilot, Cursor, and others use semantic indexing through IDE integrations or GitHub's stack graphs because they precise accurate code navigation across files.

Most AI security tools haven't made the same shift. They feed LLMs ASTs or taint traces and expect them to find broken access control. But a missing authorization check doesn't show up in a taint trace because there's nothing to trace.

submitted by /u/Same-Cauliflower-830
[link] [comments]

You can still claim your refund in Amazon's $2.5 billion Prime settlement - here's how

The FTC says Amazon tricked customers into signing up for a Prime subscription and made it difficult to cancel. Check if you're eligible for a payout.

Meet Prism, OpenAI's free research workspace for scientists - how to try it

Powered by GPT-5.2, Prism helps you draft papers, source contextualized references, and more - just don't delegate your research to it.

This Anker portable power station for $370 off on Amazon is a steal - and it's great for the winter

Whether winter storms have knocked out your electricity or you're just looking to stay prepared for the next one, the Anker Solix C1000 is a solid choice.

One-Click Hack Against Popular Video Platform

By: ／u／derp6996

Team82 uncovered a new vulnerability in the IDIS Cloud Manager (ICM) viewer; an attacker could develop an exploit whereby if a user clicks on an untrusted link, the attack would execute on the machine hosting the ICM Viewer.

submitted by /u/derp6996
[link] [comments]

Your Android phone just got a powerful anti-theft upgrade. Here's what's new

These updates give you more control over your device's security.

Audited hypervisor kernel escapes in regulated environments β€” Ring 0 is the real attack surface

By: ／u／NTCTech

I've been auditing hypervisor kernel security in several regulated environments recently, focusing on post-compromise survivability rather than initial breach prevention.

One pattern keeps showing up: most hardening guidance focuses on management planes and guest OSes, but real-world escape chains increasingly pivot through the host kernel (Ring 0).

From recent CVEs (ESXi heap overflows, vmx_exit handler bugs, etc.), three primitives appear consistently in successful guest β†’ host escapes:

  1. Unsigned drivers / DKOM
    If an attacker can load a third-party module, they often bypass scheduler controls entirely. Many environments still relax signature enforcement for compatibility with legacy agents, which effectively enables kernel write primitives.

  2. Memory corruption vs. KASLR
    KASLR is widely relied on, but without strict kernel lockdown, leaking the kernel base address is often trivial via side channels. Once offsets are known, KASLR loses most of its defensive value.

  3. Kernel write primitives
    HVCI/VBS or equivalent kernel integrity enforcement introduces measurable performance overhead (we saw ~12–18% CPU impact in some workloads), but appears to be one of the few effective controls against kernel write primitives once shared memory is compromised.

I’m curious what others are seeing in production:

  • Are you enforcing strict kernel lockdown / signed modules on hypervisors?
  • Are driver compatibility or performance constraints forcing exceptions?
  • Have you observed real-world guest β†’ host escapes that weren’t rooted in kernel memory corruption or unsigned drivers?

Looking to compare field experiences rather than promote any particular stack.

submitted by /u/NTCTech
[link] [comments]

WhatsApp Rolls Out Lockdown-Style Security Mode to Protect Targeted Users From Spyware

By: Ravie Lakshmanan
Meta on Tuesday announced it's adding Strict Account Settings on WhatsApp to secure certain users against advanced cyber attacks because of who they are and what they do. The feature, similar to Lockdown Mode in Apple iOS and Advanced Protection in Android, aims to protect individuals, such as journalists or public-facing figures, from sophisticated spyware by trading some functionality for

Experts Detect Pakistan-Linked Cyber Campaigns Aimed at Indian Government Entities

By: Ravie Lakshmanan
Indian government entities have been targeted in two campaigns undertaken by a threat actor that operates in Pakistan using previously undocumented tradecraft. The campaigns have been codenamed Gopher Strike and Sheet Attack by Zscaler ThreatLabz, which identified them in September 2025. "While these campaigns share some similarities with the Pakistan-linked Advanced Persistent Threat (APT)

This $7 cable is secretly the most useful thing in my tech bag

The Vafoton PD 240W Thunderbolt 4 cable supports 40Gbps data transfer and is durable enough to clip to my backpack.

If these Samsung Galaxy S26 rumors are true, I might finally put my Google Pixel loyalty to rest

I've been a Google Pixel phone user for nearly a decade, but Samsung might have a compelling case for switching this year.

China-linked group accused of spying on phones of UK prime ministers' aides – for years

Reports say Salt Typhoon attackers accessed handsets of senior govt folk

Chinese state-linked hackers are accused of spending years inside the phones of senior Downing Street officials, exposing private communications at the heart of the UK government.…

Use Microsoft Office? Hackers can infect your PC with a malicious document - patch it ASAP

This emergency zero-day patch blocks attackers from slipping past built-in protections and compromising your system.

5 ways you can stop testing AI and start scaling it responsibly in 2026

The moment is now. CIOs are eager to move from AI experimentation to tangible returns. Here's how you can do it too, safely.

ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services

By: Ravie Lakshmanan
Cybersecurity researchers have disclosed details of a new campaign that combines ClickFix-style fake CAPTCHAs with a signed Microsoft Application Virtualization (App-V) script to distribute an information stealer called Amatera. "Instead of launching PowerShell directly, the attacker uses this script to control how execution begins and to avoid more common, easily recognized execution paths,"

Why the internet kept breaking and taking down your favorite sites in 2025

There's a reason outages kept frustrating users last year, according to Cloudflare.

France to replace US videoconferencing wares with unfortunately named sovereign alternative

French govt says state-run service 'Visio'Β will be more secure. Now where have we heard that name before?

France has officially told Zoom, Teams, and the rest of the US videoconferencing herd to take a hike in favor of its own homegrown app.…

I finally tested a Windows laptop with Intel's Panther Lake chip - and the hype is justified

Asus' ExpertBook Ultra B9 is as ultraportable as it is powerful, with Intel's latest chipset and a stunning OLED display.

Microsoft illegally installed cookies on schoolkid's tech, data protection ruling finds

Austrian education ministry unaware of tracking software until campaigners launched case

Updated Microsoft illegally installed cookies on a school pupil's devices without consent, according to a ruling by the Austrian data protection authority (DSB).…

The best email encryption software of 2026: Expert tested

The best email encryption software can prevent hackers from scraping your emails for company contracts, financial records, and workplace credentials.

CTEM in Practice: Prioritization, Validation, and Outcomes That Matter

By: Unknown
Cybersecurity teams increasingly want to move beyond looking at threats and vulnerabilities in isolation. It’s not only about what could go wrong (vulnerabilities) or who might attack (threats), but where they intersect in your actual environment to create real, exploitable exposure. Which exposures truly matter? Can attackers exploit them? Are our defenses effective? Continuous Threat Exposure

High Court to grill London cops over live facial recognition creep

Victim and Big Brother Watch will argue the Met's policies are incompatible with human rights law

The High Court will hear from privacy campaigners this week who want to reshape the way the Metropolitan Police is allowed to use live facial recognition (LFR) tech.…

Revealed: Leaked Chats Expose the Daily Life of a Scam Compound’s Enslaved Workforce

By: Andy Greenberg， Lily Hay Newman， Matt Burgess
A whistleblower trapped inside a β€œpig butchering” scam compound gave WIRED a vast trove of its internal materialsβ€”including 4,200 pages of messages that lay out its operations in unprecedented detail.

He Leaked the Secrets of a Southeast Asian Scam Compound. Then He Had to Get Out Alive

By: Andy Greenberg
A source trapped inside an industrial-scale scamming operation contacted me, determined to expose his captors’ crimesβ€”and then escape. This is his story.

Critical Grist-Core Vulnerability Allows RCE Attacks via Spreadsheet Formulas

By: Ravie Lakshmanan
A critical security flaw has been disclosed in Grist‑Core, an open-source, self-hosted version of the Grist relational spreadsheet-database, that could result in remote code execution. The vulnerability, tracked as CVE-2026-24002 (CVSS score: 9.1), has been codenamed Cellbreak by Cyera Research Labs. "One malicious formula can turn a spreadsheet into a Remote Code Execution (RCE) beachhead,"

Office zero-day exploited in the wild forces Microsoft OOB patch

Another actively abused Office bug, another emergency patch – Office 2016 and 2019 users are left with registry tweaks instead of fixes.

Updated Microsoft has issued an emergency Office patch after confirming a zero-day flaw is already being used in real world attacks.…

Weekly Update 488

By: Troy Hunt
Weekly Update 488

It's the discussion about the reaction of some people in the UK regarding their impending social media ban for under 16s that bugged me most. Most noteably was the hand-waving around "the gov is just trying to siphon up all our IDs" and "this means everyone will have to show ID, not just under 16s". If only there was another precedent somewhere in the world where precisely this model was rolled... oh - wait! 🐨 The way the ban (sorry - "delay") has been done in Australia isn't perfect, but it also doesn't have to be. There are still plenty of under 16s with access so socials, but I do not know of a single adult who had had to show any form of ID or do any age verification whatsoever. So, relax, wait until we know more about how thye're planning to do it (and the UK gov will be closely looking at the Aussie precedent), and then lose your minds if it's done totally differently at the expense of everyone's privacy.

Weekly Update 488
Weekly Update 488
Weekly Update 488
Weekly Update 488

❌