Cybersecurity

Feeds last updated @: UTC - 22:45 - 23/02/2026

Security.nl

More

Slashdot

 Edit

Panasonic Will No Longer Make Its Own TVs

  View item as page
Panasonic is handing over the manufacturing, marketing, and sales of its TVs to Shenzhen-based Skyworth, effectively exiting in-house TV production. Ars Technica reports: Skyworth is a Shenzhen-headquartered TV brand. The company claims to be "a top three global provider of the Android TV platform." In July, research firm Omdia reported that Skyworth was one of the top-five TV brands by sales revenue in Q1 2025; however, Skyworth hasn't been able to maintain that position regularly. Panasonic made its announcement at a "launch event," FlatpanelsHD reported today. During the event, a Panasonic representative reportedly said: "Under the agreement the new partner will lead sales, marketing, and logistics across the region, while Panasonic provide expertise and quality assurance to uphold its renowned audiovisual standards with full joint development on top-end OLED models." Panasonic also said that it will provide support "for all Panasonic TVs sold up to March 2026 and all those available from April." Skyworth-made Panasonic TVs will be sold in the US and Europe. In the latter geography, the companies are aiming for double-digit market share. [...] The news means there's virtually no TV production happening in Japan anymore, as other Japanese companies, like Sharp, Toshiba, Hitachi, and Pioneer, have already exited TV production. Earlier this year, Sony announced that it was ceding control of its TV hardware business to TCL.

Read more of this story at Slashdot.

https://entertainment.slashdot.org/story/26/02/23/229229/panasonic-will-no-longer-make-its-own-tvs?utm_source=rss1.0mainlinkanon&utm_medium=feed

 Edit

ASML Unveils EUV Light Source Advance That Could Yield 50% More Chips By 2030

  View item as page
An anonymous reader quotes a report from Reuters: Researchers at ASML Holding say they have found a way to boost the power of the light source in a key chip making machine to turn out up to 50% more chips by decade's end, to help retain the Dutch company's edge over emerging U.S. and Chinese rivals. ASML is the world's only maker of commercial extreme ultraviolet lithography (EUV) machines, a critical tool for chipmakers such as TSMC, Intel and others in producing advanced computing chips. "It's not a parlor trick or something like this, where we demonstrate for a very short time that it can work," Michael Purvis, ASML's lead technologist for its EUV source light, said in an interview. "It's a system that can produce 1,000 watts under all the same requirements that you could see at a customer," he added, speaking at the company's California facilities near San Diego. [...] With the technological advance revealed on Monday, which is being reported here for the first time, ASML aims to outdistance any would-be rivals by improving the most technologically challenging aspect of the machines. This is the quest to generate EUV light with the right power and properties to turn out chips at high volume. The company's researchers have found a way to boost the power of the EUV light source to 1,000 watts from 600 watts now. The chief advantage is that greater power translates into the ability to make more chips every hour, helping to lower the cost of each. Chips are printed similar to a photograph, where the EUV light is shone on a silicon wafer coated with special chemicals called a photoresist. With a more powerful EUV light source, chip factories need shorter exposure times. "We'd like to make sure that our customers can keep on using EUV at a much lower cost," Teun van Gogh, executive vice president for the NXE line of EUV machines at ASML, told Reuters. Van Gogh said customers should be able to process about 330 silicon wafers an hour on each machine by the end of the decade, up from 220 now. Depending on the size of a chip, each wafer can hold anywhere from scores to thousands of the devices. ASML got the power boost by doubling down on an approach that already places its machines among the most complex inventions of humans. To produce light with a wavelength of 13.5 nanometers, ASML's machine shoots a stream of molten droplets of tin through a chamber, where a massive carbon dioxide laser heats them into plasma. This is a superheated state of matter in which the tin droplets become hotter than the sun and emit EUV light, to be collected by precision optic equipment supplied by Germany's Carl Zeiss AG and fed into the machine to print chips. The key advancements in Monday's disclosure involved doubling the number of tin drops to about 100,000 every second, and shaping them into plasma using two smaller laser bursts, as opposed to today's machines that use a single shaping burst. [...] ASML believes the techniques it used to hit 1,000 watts will unlock continued advances in the future, Purvis said, adding, "We see a reasonably clear path toward 1,500 watts, and no fundamental reason why we couldn't get to 2,000 watts."

Read more of this story at Slashdot.

https://hardware.slashdot.org/story/26/02/23/2155225/asml-unveils-euv-light-source-advance-that-could-yield-50-more-chips-by-2030?utm_source=rss1.0mainlinkanon&utm_medium=feed

 Edit

IBM Shares Crater 13% After Anthropic Says Claude Code Can Tackle COBOL Modernization

  View item as page
IBM shares plunged nearly 13% on Monday after Anthropic published a blog post arguing that its Claude Code tool could automate much of the complex analysis work involved in modernizing COBOL, the decades-old programming language that still underpins an estimated 95% of ATM transactions in the United States and runs on the kind of mainframe systems IBM has sold for generations. Anthropic said the shrinking pool of developers who understand COBOL had long made modernization cost-prohibitive, and that AI could now flip that equation by mapping dependencies and documenting workflows across thousands of lines of legacy code. The sell-off deepened a rough 2026 for IBM, whose shares are now down more than 22% year to date.

Read more of this story at Slashdot.

https://slashdot.org/story/26/02/23/2110221/ibm-shares-crater-13-after-anthropic-says-claude-code-can-tackle-cobol-modernization?utm_source=rss1.0mainlinkanon&utm_medium=feed

 Edit

Linus Torvalds: Someone 'More Competent Who Isn't Afraid of Numbers Past the Teens' Will Take Over Linux One Day

  View item as page
Linus Torvalds has pondered his professional mortality in a self-deprecating post to mark the release of the first release candidate for version 7.0 of the Linux kernel. From a report: "You all know the drill by now: two weeks have passed, and the kernel merge window is closed," he wrote in the post announcing Linux 7.0 rc1. "We have a new major number purely because I'm easily confused and not good with big numbers." Torvalds pointed out that the numbers he applies to new kernel releases are essentially meaningless. "We haven't done releases based on features (or on "stable vs unstable") for a long, long time now. So that new major number does *not* mean that we have some big new exciting feature, or that we're somehow leaving old interfaces behind. It's the usual "solid progress" marker, nothing more.â He then reiterated his plan to end each series of kernels to end at x.19, before the next release becomes y.0 -- a process that takes about 3.5 years -- and then pondered what happens when the next version of Linux reaches a number he finds uncomfortable. "I don't have a solid plan for when the major number itself gets big," he admitted, "by that time, I expect that we'll have somebody more competent in charge who isn't afraid of numbers past the teens. So I'm not going to worry about it."

Read more of this story at Slashdot.

https://linux.slashdot.org/story/26/02/23/1936208/linus-torvalds-someone-more-competent-who-isnt-afraid-of-numbers-past-the-teens-will-take-over-linux-one-day?utm_source=rss1.0mainlinkanon&utm_medium=feed

 Edit

'How Many AIs Does It Take To Read a PDF?'

  View item as page
Despite AI's progress in building complex software, the ubiquitous PDF remains something of a grand challenge -- a format Adobe developed in the early 1990s to preserve the precise visual appearance of documents. PDFs consist of character codes, coordinates, and rendering instructions rather than logically ordered text, and even state-of-the-art models asked to extract information from them will summarize instead, confuse footnotes with body text, or outright hallucinate contents, The Verge writes. Companies like Reducto are now tackling the problem by segmenting pages into components -- headers, tables, charts -- before routing each to specialized parsing models, an approach borrowed from computer vision techniques used in self-driving vehicles. Researchers at Hugging Face recently found roughly 1.3 billion PDFs sitting in Common Crawl alone, and the Allen Institute for AI has noted that PDFs could provide trillions of novel, high-quality training tokens from government reports, textbooks, and academic papers -- the kind of data AI developers are increasingly desperate for.

Read more of this story at Slashdot.

https://it.slashdot.org/story/26/02/23/1833239/how-many-ais-does-it-take-to-read-a-pdf?utm_source=rss1.0mainlinkanon&utm_medium=feed

More

theregister.com/security

 Edit

Global regulators say AI image tools don't get a free pass on privacy rules

  View item as page
Watchdogs warn models that can generate realistic images of people must comply with data protection laws

A global coalition of privacy watchdogs has fired a warning shot at the generative AI industry, saying companies churning out realistic synthetic images can't pretend that data protection rules don't apply....

https://go.theregister.com/feed/www.theregister.com/2026/02/23/privacy_watchdogs_ai_images/

More

CISO2CISO.com

 Edit

The Critical Role of Sboms (Software Bill of Materials) In Defending Medtech From Software Supply Chain Threats – Source: www.cyberdefensemagazine.com

  View item as page

Source: www.cyberdefensemagazine.com – Author: News team Software supply chain attacks have emerged as a serious threat in the rapidly evolving field of cybersecurity, especially in medical devices. As these devices become more and more interconnected and dependent on complex software ecosystems, the potential for exploitation through the supply chain has grown exponentially. One powerful tool [...]

La entrada The Critical Role of Sboms (Software Bill of Materials) In Defending Medtech From Software Supply Chain Threats – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

https://ciso2ciso.com/the-critical-role-of-sboms-software-bill-of-materials-in-defending-medtech-from-software-supply-chain-threats-source-www-cyberdefensemagazine-com/

 Edit

Ransomware Tactics Are Shifting. Here’s How to Keep Up – Source: www.cyberdefensemagazine.com

  View item as page

Source: www.cyberdefensemagazine.com – Author: News team It’s common knowledge in the cybersecurity industry that ransomware is on the rise, with median demands rising 20% year-over-year across virtually all industries. But it’s not only the ransom sums themselves that are escalating; threat actors are engaging in increasingly aggressive tactics and techniques to extort their victims. It’s [...]

La entrada Ransomware Tactics Are Shifting. Here’s How to Keep Up – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

https://ciso2ciso.com/ransomware-tactics-are-shifting-heres-how-to-keep-up-source-www-cyberdefensemagazine-com/

 Edit

French Advisory Sheds Light on Apple Spyware Activity – Source: www.darkreading.com

  View item as page

Source: www.darkreading.com – Author: Rob Wright CERT-FR’s advisory follows last month’s disclosure of a zero-day flaw Apple said was used in “sophisticated” attacks against targeted individuals. Original Post URL: https://www.darkreading.com/vulnerabilities-threats/french-sheds-light-apple-spyware-activity Category & Tags: – Views: 9

La entrada French Advisory Sheds Light on Apple Spyware Activity – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

https://ciso2ciso.com/french-advisory-sheds-light-on-apple-spyware-activity-source-www-darkreading-com/

More

Hackread.com

More

Vuldb

 Edit

CVE-2026-3070 | SourceCodester Modern Image Gallery App 1.0 upload.php filename cross site scripting

  View item as page
A vulnerability classified as problematic was found in SourceCodester Modern Image Gallery App 1.0. Affected by this vulnerability is an unknown functionality of the file upload.php. The manipulation of the argument filename results in cross site scripting. This vulnerability is cataloged as CVE-2026-3070. The attack may be launched remotely. Furthermore, there is an exploit available.

https://vuldb.com/?id.347425

 Edit

CVE-2026-3068 | itsourcecode Document Management System 1.0 /deluser.php user2del sql injection

  View item as page
A vulnerability described as critical has been identified in itsourcecode Document Management System 1.0. This impacts an unknown function of the file /deluser.php. Executing a manipulation of the argument user2del can lead to sql injection. This vulnerability is tracked as CVE-2026-3068. The attack can be launched remotely. Moreover, an exploit is present.

https://vuldb.com/?id.347423

More

Debian.org/security

More

Microsoft Security

More

advisories.ncsc.nl

 Edit

NCSC-2026-0068 [1.00] [M/H] Kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform

  View item as page
Splunk heeft kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform. De kwetsbaarheden bevinden zich in verschillende versies van Splunk Enterprise en Splunk Cloud Platform. Ze stellen laaggeprivilegieerde gebruikers in staat om beveiligingen te omzeilen, gevoelige informatie te bekijken, en de REST API te misbruiken voor gebruikersauthenticatie. Dit kan leiden tot ongeautoriseerde toegang en verstoring van de service. Specifieke versies van Splunk Enterprise zijn kwetsbaar voor toegang tot de Monitoring Console App endpoints en het inzien van gevoelige configuraties zoals Duo Two-Factor Authentication sleutels, RSA accessKeys, en SAML configuraties in platte tekst. Deze kwetsbaarheden kunnen de integriteit en vertrouwelijkheid van gegevens en authenticatieprocessen in gevaar brengen.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0068

 Edit

NCSC-2026-0043 [1.02] [H/H] Zeroday-kwetsbaarheden verholpen in Ivanti Endpoint Manager Mobile

  View item as page
Ivanti heeft twee kwetsbaarheden verholpen in Endpoint Manager Mobile (EPMM), ook wel bekend als MobileIron. De kwetsbaarheden stellen een ongeauthenticeerde kwaadwillende in staat om willekeurige code uit te voeren op het kwetsbare systeem. Van de kwetsbaarheid met kenmerk CVE-2026-1281 meldt Ivanti dat deze actief is misbruikt bij een zeer beperkt aantal klanten. Er is Proof-of-Concept-code publiek beschikbaar. Dit vergroot de kans grootschalig misbruik aanzienlijk. **Update**: Afhankelijk van de configuratie van EPMM kan deze toegang verlenen tot het Sentry systeem. Hierdoor kan compromittatie van het EPMM systeem kwaadwillenden mogelijk toegang tot het Sentry systeem verschaffen. Hiervoor is toegang tot de keystore op het EPMM systeem vereist. Onderzoek het Sentry systeem op verdachte toegang en verdacht verkeer vanaf EPMM.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0043

 Edit

NCSC-2026-0067 [1.00] [M/H] Kwetsbaarheden verholpen in GitHub Enterprise Server

  View item as page
GitHub heeft kwetsbaarheden verholpen in GitHub Enterprise Server (Specifiek voor versies vóór 3.20, 3.19.2, 3.18.5 en 3.17.11). De eerste kwetsbaarheid betreft een autorisatieprobleem dat het mogelijk maakte voor aanvallers om ongeautoriseerde pull-requests samen te voegen in repositories die fork-ondersteuning bieden. De tweede kwetsbaarheid betreft een ontbrekende autorisatie die aanvallers in staat stelde om ongeautoriseerde inhoud te uploaden naar de migratie-export van een andere gebruiker. Beide kwetsbaarheden zijn opgelost in de genoemde versies.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0067

 Edit

NCSC-2026-0066 [1.00] [M/H] Kwetsbaarheid verholpen in Google Chrome

  View item as page
Google heeft een kwetsbaarheid verholpen in Google Chrome (voor versies vóór 145.0.7632.75). De kwetsbaarheid bevindt zich in de wijze waarop Google Chrome omgaat met CSS en betreft een use-after-free probleem. Dit kan leiden tot remote code execution via speciaal gemaakte HTML-pagina's. Zowel Google Chrome als Microsoft Edge (op basis van Chromium) zijn getroffen. Er is exploit code beschikbaar voor CVE-2026-2441.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0066

 Edit

NCSC-2026-0065 [1.00] [M/H] Kwetsbaarheid verholpen in Dell RecoverPoint for Virtual Machines

  View item as page
Dell heeft een kwetsbaarheid verholpen in Dell RecoverPoint for Virtual Machines (versies voor 6.0.3.1 HF1). De kwetsbaarheid bevindt zich in hardcoded inloggegevens die aanwezig zijn in de software. Dit stelt ongeauthenticeerde aanvallers op hetzelfde netwerk in staat om ongeautoriseerde toegang tot het systeem te verkrijgen. Dit kan de integriteit en vertrouwelijkheid van de getroffen omgevingen in gevaar brengen. Daarbij meldt GTIG dat zij misbruik van de desbetreffende kwetsbaarheid hebben waargenomen sinds ten minste medio 2024, dus al vóór de patch. In de bijgevoegde blogpost heeft GTIG Indicators of Compromise (IoC’s) en YARA-regels opgenomen om de gebruikte malware te kunnen identificeren.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0065

More

NCSC Nieuws

NIST Cybersecurity

wid.cert-bund.de

More

cert.ssi.gouv.fr

More

theHackerNews

 Edit

APT28 Targeted European Entities Using Webhook-Based Macro Malware

  View item as page
The Russia-linked state-sponsored threat actor tracked as APT28 has been attributed to a new campaign targeting specific entities in Western and Central Europe. The activity, per S2 Grupo's LAB52 threat intelligence team, was active between September 2025 and January 2026. It has been codenamed Operation MacroMaze. "The campaign relies on basic tooling and the exploitation of legitimate services

https://thehackernews.com/2026/02/apt28-targeted-european-entities-using.html

 Edit

Wormable XMRig Campaign Uses BYOVD Exploit and Time-Based Logic Bomb

  View item as page
Cybersecurity researchers have disclosed details of a new cryptojacking campaign that uses pirated software bundles as lures to deploy a bespoke XMRig miner program on compromised hosts. "Analysis of the recovered dropper, persistence triggers, and mining payload reveals a sophisticated, multi-stage infection prioritizing maximum cryptocurrency mining hashrate, often destabilizing the victim

https://thehackernews.com/2026/02/wormable-xmrig-campaign-uses-byovd.html

 Edit

⚡ Weekly Recap: Double-Tap Skimmers, PromptSpy AI, 30Tbps DDoS, Docker Malware & More

  View item as page
Security news rarely moves in a straight line. This week, it feels more like a series of sharp turns, some happening quietly in the background, others playing out in public view. The details are different, but the pressure points are familiar. Across devices, cloud services, research labs, and even everyday apps, the line between normal behavior and hidden risk keeps getting thinner. Tools

https://thehackernews.com/2026/02/weekly-recap-double-tap-skimmers.html

 Edit

How Exposed Endpoints Increase Risk Across LLM Infrastructure

  View item as page
As more organizations run their own Large Language Models (LLMs), they are also deploying more internal services and Application Programming Interfaces (APIs) to support those models. Modern security risks are being introduced less from the models themselves and more from the infrastructure that serves, connects and automates the model. Each new LLM endpoint expands the attack surface, often in

https://thehackernews.com/2026/02/how-exposed-endpoints-increase-risk.html

 Edit

Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens

  View item as page
Cybersecurity researchers have disclosed what they say is an active "Shai-Hulud-like" supply chain worm campaign that has leveraged a cluster of at least 19 malicious npm packages to enable credential harvesting and cryptocurrency key theft. The campaign has been codenamed SANDWORM_MODE by supply chain security company Socket. As with prior Shai-Hulud attack waves, the malicious code embedded

https://thehackernews.com/2026/02/malicious-npm-packages-harvest-crypto.html

More

Techrepublic

More

BleepingComputer.com

More

securityboulevard.com

 Edit

NDSS 2025 – Generating API Specifications For Bug Detection Via Specification Propagation Analysis

  View item as page

Session 13B: API Security

Authors, Creators & Presenters: Miaoqian Lin (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Kai Chen (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Yi Yang (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Jinghua Liu (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China)

PAPER
Uncovering The Iceberg From The Tip: Generating API Specifications For Bug Detection Via Specification Propagation Analysis

Modern software often provides diverse APIs to facilitate development. Certain APIs, when used, can affect variables and require post-handling, such as error checks and resource releases. Developers should adhere to their usage specifications when using these APIs. Failure to do so can cause serious security threats, such as memory corruption and system crashes. Detecting such misuse depends on comprehensive API specifications, as violations of these specifications indicate API misuse. Previous studies have proposed extracting API specifications from various artifacts, including API documentation, usage patterns, and bug patches. However, these artifacts are frequently incomplete or unavailable for many APIs. As a result, the lack of specifications for uncovered APIs causes many false negatives in bug detection. In this paper, we introduce the idea of API Specification Propagation, which suggests that API specifications propagate through hierarchical API call chains. In particular, modern software often adopts a hierarchical API design, where high-level APIs build on low-level ones. When high-level APIs wrap low-level ones, they may inherit the corresponding specifications. Based on this idea, we present APISpecGen, which uses known specifications as seeds and performs bidirectional propagation analysis to generate specifications for new APIs. Specifically, given the seed specifications, APISpecGen infers which APIs the specifications might propagate to or originate from. To further generate specifications for the inferred APIs, APISpecGen combines API usage and validates them using data-flow analysis based on the seed specifications. Besides, APISpecGen iteratively uses the generated specifications as new seeds to cover more APIs. For efficient and accurate analysis, APISpecGen focuses only on code relevant to the specifications, ignoring irrelevant semantics. We implemented APISpecGen and evaluated it for specification generation and API misuse detection. With 6 specifications as seeds, APISpecGen generated 7332 specifications. Most of the generated specifications could not be covered by state-of-the-art work due to the quality of their sources. With the generated specifications, APISpecGen detected 186 new bugs in the Linux kernel, 113 of them have been confirmed by the developers, with 8 CVEs assigned.

ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.

Permalink

The post NDSS 2025 – Generating API Specifications For Bug Detection Via Specification Propagation Analysis appeared first on Security Boulevard.

https://securityboulevard.com/2026/02/ndss-2025-generating-api-specifications-for-bug-detection-via-specification-propagation-analysis/

 Edit

Inside Attacker’s Defensive Funnel: How Sneaky 2FA Cloaks Itself from Security Scanners – Blog | Menlo Security

  View item as page

Learn how Menlo Security identified a massive Sneaky 2FA phishing campaign using 3.4K domains to bypass Microsoft 365 MFA and steal session cookies.

The post Inside Attacker’s Defensive Funnel: How Sneaky 2FA Cloaks Itself from Security Scanners – Blog | Menlo Security appeared first on Security Boulevard.

https://securityboulevard.com/2026/02/inside-attackers-defensive-funnel-how-sneaky-2fa-cloaks-itself-from-security-scanners-blog-menlo-security/

More

CXSecurity.com

More

Brian Krebs

 Edit

‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA

  View item as page
Most phishing websites are little more than static copies of login pages for popular online destinations, and they are often quickly taken down by anti-abuse activists and security firms. But a stealthy new phishing-as-a-service offering lets customers sidestep both of these pitfalls: It uses cleverly disguised links to load the target brand's real website, and then acts as a relay between the target and the legitimate site -- forwarding the victim's username, password and multi-factor authentication (MFA) code to the legitimate site and returning its responses.

https://krebsonsecurity.com/2026/02/starkiller-phishing-service-proxies-real-login-pages-mfa/

 Edit

Kimwolf Botnet Swamps Anonymity Network I2P

  View item as page
For the past week, the massive "Internet of Things" (IoT) botnet known as Kimwolf has been disrupting the The Invisible Internet Project (I2P), a decentralized, encrypted communications network designed to anonymize and secure online communications. I2P users started reporting disruptions in the network around the same time the Kimwolf botmasters began relying on it to evade takedown attempts against the botnet's control servers.

https://krebsonsecurity.com/2026/02/kimwolf-botnet-swamps-anonymity-network-i2p/

 Edit

Who Operates the Badbox 2.0 Botnet?

  View item as page
The cybercriminals in control of Kimwolf -- a disruptive botnet that has infected more than 2 million devices -- recently shared a screenshot indicating they'd compromised the control panel for Badbox 2.0, a vast China-based botnet powered by malicious software that comes pre-installed on many Android TV streaming boxes. Both the FBI and Google say they are hunting for the people behind Badbox 2.0, and thanks to bragging by the Kimwolf botmasters we may now have a much clearer idea about that.

https://krebsonsecurity.com/2026/01/who-operates-the-badbox-2-0-botnet/

More

Troy Hunt

More

Bruce Schneier

 Edit

On the Security of Password Managers

  View item as page

Good article on password managers that secretly have a backdoor.

New research shows that these claims aren’t true in all cases, particularly when account recovery is in place or password managers are set to share vaults or organize users into groups. The researchers reverse-engineered or closely analyzed Bitwarden, Dashlane, and LastPass and identified ways that someone with control over the server­—either administrative or the result of a compromise­—can, in fact, steal data and, in some cases, entire vaults. The researchers also devised other attacks that can weaken the encryption to the point that ciphertext can be converted to plaintext...

https://www.schneier.com/blog/archives/2026/02/on-the-security-of-password-managers.html

 Edit

Malicious AI

  View item as page

Interesting:

Summary: An AI agent of unknown ownership autonomously wrote and published a personalized hit piece about me after I rejected its code, attempting to damage my reputation and shame me into accepting its changes into a mainstream python library. This represents a first-of-its-kind case study of misaligned AI behavior in the wild, and raises serious concerns about currently deployed AI agents executing blackmail threats.

Part 2 of the story. And a Wall Street Journal article.

EDITED TO ADD (2/20) Here are parts 3, and 4 of the story...

https://www.schneier.com/blog/archives/2026/02/malicious-ai.html

 Edit

AI Found Twelve New Vulnerabilities in OpenSSL

  View item as page

The title of the post is”What AI Security Research Looks Like When It Works,” and I agree:

In the latest OpenSSL security release> on January 27, 2026, twelve new zero-day vulnerabilities (meaning unknown to the maintainers at time of disclosure) were announced. Our AI system is responsible for the original discovery of all twelve, each found and responsibly disclosed to the OpenSSL team during the fall and winter of 2025. Of those, 10 were assigned CVE-2025 identifiers and 2 received CVE-2026 identifiers. Adding the 10 to the three we already found in the ...

https://www.schneier.com/blog/archives/2026/02/ai-found-twelve-new-vulnerabilities-in-openssl.html

More

Security Affairs

 Edit

Wormable XMRig campaign leverages BYOVD and timed kill switch for stealth

  View item as page
A wormable cryptojacking campaign spreads via pirated software, using BYOVD and a time-based logic bomb to deploy a custom XMRig miner. Researchers uncovered a wormable cryptojacking campaign that spreads through pirated software bundles to deploy a custom XMRig miner. The attack uses a BYOVD exploit and a time-based logic bomb to evade detection and maximize [...]

https://securityaffairs.com/188388/malware/wormable-xmrig-campaign-leverages-byovd-and-timed-kill-switch-for-stealth.html

 Edit

Romanian hacker pleads guilty to selling access to Oregon state networks

  View item as page
A Romanian man pleaded guilty to selling admin access to Oregon’s state network for $3,000 in Bitcoin and repeatedly accessing it to prove control. Catalin Dragomir (45) from Romania, pleaded guilty in the U.S. for selling unauthorized admin access to an Oregon state emergency management network. He gained access in June 2021, advertised it, and [...]

https://securityaffairs.com/188380/cyber-crime/romanian-hacker-pleads-guilty-to-selling-access-to-oregon-state-networks.html

 Edit

CVE-2026-1731 fuels ongoing attacks on BeyondTrust remote access products

  View item as page
Attackers are exploiting CVE-2026-1731 in BeyondTrust RS and PRA to deploy VShell, gain persistence, move laterally, and control compromised systems. Threat actors are actively exploiting a recently disclosed critical vulnerability, tracked as CVE-2026-1731 (CVSS score: 9.9), in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). The flaw is being used to conduct a wide [...]

https://securityaffairs.com/188370/hacking/cve-2026-1731-fuels-ongoing-attacks-on-beyondtrust-remote-access-products.html

 Edit

AI-powered campaign compromises 600 FortiGate systems worldwide

  View item as page
A Russian-speaking cybercriminal used commercial generative AI tools to hack over 600 FortiGate devices across 55 countries. Amazon Threat Intelligence reports that a Russian-speaking, financially motivated threat actor used commercial generative AI services to compromise more than 600 FortiGate devices in 55 countries. The activity, observed between January 11 and February 18, 2026, highlights how [...]

https://securityaffairs.com/188351/hacking/ai-powered-campaign-compromises-600-fortigate-systems-worldwide.html

 Edit

Anthropic unveils Claude Code Security to detect and fix code bugs

  View item as page
Anthropic launches Claude Code Security, an AI tool that scans code for vulnerabilities and suggests how to address them. Anthropic has introduced Claude Code Security, a new AI-powered service designed to scan software codebases for vulnerabilities and recommend fixes. Built into Claude Code, the tool aims to help teams detect and remediate security flaws faster. [...]

https://securityaffairs.com/188358/ai/anthropic-unveils-claude-code-security-to-detect-and-fix-code-bugs.html

More

news.sophos.com