TECHZONE™

73% of Organizations Say They Are Not Fully Ready for a Major Cyberattack https://thehackernews.com/2026/07/73-of-organizations-say-they-are-not.html Most organizations have incident response plans, security tools, and technical teams in place. Yet new research suggests that many still lack the coordination, visibility, and executive alignment needed to withstand a serious cyberattack. According to The State of Incident Response Readiness 2026, based on a survey of 600 senior IT security decision makers conducted by Vanson Bourne in January

Russia Charges Telegram Founder Pavel Durov With Aiding Terrorist Activity https://thehackernews.com/2026/07/russia-charges-telegram-founder-pavel.html The Federal Security Service of the Russian Federation (FSB) on Wednesday said it charged Telegram founder Pavel Durov for allegedly facilitating terrorist activities and for failing to remove prohibited information in violation of Russian law. The principal security agency said the instant messaging platform "failed to remove numerous channels, chats, and bots on the platform that are

Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass https://thehackernews.com/2026/07/rapid7-releases-poc-for-exploited-check.html Cybersecurity researchers have shared additional technical details about a recently patched critical security flaw impacting Check Point Security Management Server and Multi-Domain Security Management Server (MDS) that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-16232 (CVSS score: 9.3), is an authentication bypass in the SmartConsole login process that

OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach https://thehackernews.com/2026/07/openai-agent-used-exposed-credentials.html OpenAI on Tuesday revealed the rogue artificial intelligence (AI) agent that escaped its sealed evaluation environment and broke into Hugging Face's production environment also hacked multiple third-party accounts and services as part of the attack. The latest disclosure shows that the security incident, which stemmed from an internal security test, was more extensive in scope than previously

New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands https://thehackernews.com/2026/07/new-gitea-rce-lets-repository-writers.html Gitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A user with ordinary repository write access can turn attacker-controlled patch content into a live Git hook and run shell commands as the Gitea service account. Tracked as CVE-2026-60004 (CVSS score: 9.8), the flaw affects Gitea versions 1.17 and later before 1.27.1 and is fixed in 1.27.1. The

Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates https://thehackernews.com/2026/07/flying-eagle-android-rat-traces-found.html Source code for the Flying Eagle Android remote access trojan (RAT) framework is circulating through criminal Telegram channels. Hunt.io and independent researcher NetAskari traced matching control panels and certificates to 170 internet servers. They linked the framework to a fake "公安一网通办" Public Security service application targeting Android users in China. The kit supports payment-password

Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js https://thehackernews.com/2026/07/two-compromised-joyfill-npm-packages.html Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan (RAT) associated with the DEV#POPPER malware family. The list of affected packages is as follows - @joyfill/layouts@0.1.2-2773.beta.0 @joyfill/components@4.0.0-rc24-2773-beta.4 The two packages "contain an import-time JavaScript implant that resolves encrypted code

Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack https://thehackernews.com/2026/07/claude-ai-just-cracked-post-quantum.html Anthropic says Claude Mythos Preview helped derive an end-to-end key-recovery attack against HAWK-256 and a 200- to 800-fold speedup for an attack on seven-round AES-128. The HAWK attack exploits a previously unused symmetry in the lattice behind the signature scheme. Anthropic's released implementation gives an expected end-to-end runtime of about three hours and 42 minutes on a 96-core server

Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process https://thehackernews.com/2026/07/tengu-botnet-reboots-compromised-linux.html A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. If that happens, Tengu's other persistence mechanisms get another chance to relaunch it. Nozomi Networks Labs observed the dropper reaching its honeypots through Telnet credential brute force. Tengu supports 25 distributed denial-of-service (

24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login https://thehackernews.com/2026/07/24650-internet-exposed-bmcs-disclose.html Cybersecurity researchers have sounded an alert after finding more than 36,000 Baseboard Management Controller (BMC) management interfaces exposing Intelligent Platform Management Interface (IPMI) protocol to the public internet. Of the 36,872 internet-exposed server-management interfaces running IPMI, 24,650 have been found to disclose password-derived authentication hashes before login due to

JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach https://thehackernews.com/2026/07/jfrog-confirms-openai-models-exploited.html JFrog has confirmed that OpenAI models exploited a zero-day in self-hosted Artifactory while trying to reach the open internet from a sealed evaluation environment. Artifactory is JFrog's software repository manager. OpenAI says the models then escalated privileges and moved laterally until they reached an internet-connected node. JFrog says it has since developed and released fixes for cloud

Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root https://thehackernews.com/2026/07/critical-openwrt-dhcpv6-flaw-could-let.html OpenWrt has shipped version 24.10.8 to close a critical DHCPv6 stack overflow and a wider set of remotely triggerable flaws in network services enabled by default. The critical issue, tracked as CVE-2026-53921 and rated 9.8 on CVSS 3.1 in OpenWrt's GitHub advisory, lets an unauthenticated attacker able to reach the DHCPv6 server overwrite a stack buffer in odhcpd through a crafted DHCPv6

Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays https://thehackernews.com/2026/07/nimbus-manticore-deploys-nightledger.html The Iranian state-backed hacking group tracked as Nimbus Manticore (aka GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549) has been attributed to a fresh set of attacks targeting entities across the Middle East, Africa, and South Asia. The intrusions involve the use of a previously undocumented Windows backdoor called NightLedger and two custom WebSocket tunnelers,

Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In https://thehackernews.com/2026/07/critical-teamcity-flaw-could-let.html JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution. The vulnerability, assigned CVE-2026-63077 (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already

Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit https://thehackernews.com/2026/07/researcher-says-ai-helped-develop-linux.html STAR Labs has published a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked as CVE-2026-53264 (CVSS score: 7.8), is a use-after-free race in the kernel's network traffic-control subsystem.Researcher Lee Jia Jie said artificial intelligence (AI) helped him find the bug and speed up exploit development. This is local

Microsoft Says New Cybersecurity AI Model Helps MDASH Hit 95.95% at Half the Cost https://thehackernews.com/2026/07/microsoft-says-new-cybersecurity-ai.html Microsoft has launched its first cybersecurity-specific model inside MDASH, its multi-model vulnerability identification and remediation harness. The company says MDASH, using MAI-Cyber-1-Flash and GPT-5.4, scored 95.95% on CyberGym. It also claims the configuration costs 50% less than its current best MDASH combination of GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex. Access is limited to approved

Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw https://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html A maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system command injection that could pave the way for arbitrary code execution. "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue

NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework https://thehackernews.com/2026/07/nvidia-forms-37-member-open-secure-ai.html NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and artificial intelligence (AI) agents. The 37-member group spans cloud, security, enterprise software, and AI companies, including Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Palo Alto Networks, Red Hat, and the Linux

Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption https://thehackernews.com/2026/07/dysphoria-iot-botnet-adds-blockchain-c2.html Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design makes the botnet harder to disrupt. CNCERT, China's national computer emergency response team, and XLab, the threat-intelligence lab of Chinese

Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw https://thehackernews.com/2026/07/public-exploit-released-for-patched.html Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval() function inside vBulletin and execute code on an unpatched forum server. The attack requires no account, administrative access, or interaction from another user. SSD Secure Disclosure lists vBulletin 6.2.1 and earlier, and 6.1.6 and earlier, as affected, but does not give a lower version