Faeem

Overview Kaspersky researchers have uncovered a sophisticated cyber campaign dubbed HelloNet, where advanced threat actors are abusing the update mechanism of ViPNet software to infiltrate Russian organizations, including government agencies. ViPNet, developed by InfoTeCS, is widely used in Russia for secure networking, VPN, endpoint protection, and messaging — making it a high‑value target for…

Overview The technology landscape is shifting rapidly, and many professionals are exploring open‑source alternatives to Microsoft’s popular software stack. A recent chart titled “Microsoft Opensource Alternatives” provides a clear visual comparison of tools like Outlook, Edge, Teams, and SQL Server against community‑driven platforms such as Thunderbird, Firefox, Mattermost, and PostgreSQL. For…

Overview AI assistants such as Claude, GPT, and Copilot can be powerful allies in your day‑to‑day tasks. They help streamline workflows, connect to local cowork resources, and even support administration of enterprise environments like Microsoft 365 tenants. Let’s break down how you can use them effectively, with a simple process overview and practical guidance for tenant management. Everyday…

Overview Cloud Software Group has disclosed two critical vulnerabilities affecting Citrix Secure Access Client for Windows and Citrix Endpoint Analysis Client for Windows. One of these flaws, CVE‑2026‑53565, allows low‑privileged users to escalate privileges to SYSTEM level, effectively giving attackers full control of affected endpoints. The Vulnerabilities CVE‑2026‑53565 Severity: CVSS v4.0…

Overview Microsoft has issued a warning about a surge in ACR Stealer malware attacks targeting enterprise customers. The malware, believed to be a rebranding of Amatera Stealer, is part of a Malware‑as‑a‑Service (MaaS) operation designed to steal browser‑stored passwords, authentication tokens, and sensitive documents. Delivery Methods Between late April and mid‑June, attackers used multiple…

Overview Ernst & Young LLP (EY) has confirmed a data breach impacting its IT support ticket platform, where attackers accessed and downloaded documents containing sensitive client tax data. The breach occurred between March 28 and April 12, 2026, giving adversaries nearly three weeks to exfiltrate information before detection. EY filed breach notifications with the California Attorney General’s…

Overview A security researcher known as Nightmare Eclipse has released a proof‑of‑concept (PoC) exploit for a new Windows zero‑day vulnerability dubbed LegacyHive. The flaw affects the Windows User Profile Service and allows attackers to escalate privileges on fully up‑to‑date systems. How LegacyHive Works The exploit abuses how Windows mounts user registry hives. PoC requirements: it needs…

Overview Two young members of the Scattered Spider cybercrime group have been sentenced to prison for a 2024 cyberattack on Transport for London (TfL) that disrupted 148 systems, forced 27,000 staff to reset passwords in person, and cost the organization approximately £29 million. The Attack Between 31 August and 3 September 2024, Thalha Jubair (20, East London) and Owen Flowers (18, Walsall)…

Overview A critical flaw in n8n’s Enterprise token exchange feature has been disclosed, tracked as CVE‑2026‑59208. The vulnerability allowed attackers to log in as users from another issuer by exploiting how n8n matched JWT tokens. The issue was patched on June 24, 2026, but the CVE record only went public on July 9. The Vulnerability Explained CVE‑2026‑59208 — improper identity binding in…

Overview A newly disclosed flaw in 7‑Zip, one of the world’s most widely used open‑source file archiving tools, could allow attackers to execute arbitrary code on vulnerable systems. Tracked as CVE‑2026‑14266, the vulnerability stems from improper handling of XZ chunked data and has been patched in the latest release. Technical Details CVE‑2026‑14266 — heap‑based buffer overflow triggered by…

Overview Researchers at Group‑IB have uncovered a new macOS information‑stealing malware dubbed ClickLock, which uses coercive social engineering loops to trap victims into entering their system login password. First submitted to VirusTotal on June 9, 2026, the malware remained undetected by security vendors and has already infected at least 100 systems across 33 countries. How ClickLock…

Overview The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive requiring federal agencies to patch a critical Oracle E-Business Suite (EBS) vulnerability by Saturday, July 18, 2026. The flaw, tracked as CVE‑2026‑46817, is being actively exploited in the wild and poses a severe risk to financial systems. The Vulnerability CVE‑2026‑46817 — Improper…

Overview Researchers at ANY.RUN have uncovered a large‑scale PhantomEnigma campaign that hijacked more than 20 Brazilian government websites to deliver malware. By exploiting trusted .gov.br domains and authenticated emails, attackers created a stealthy infection chain that put banks and public agencies at risk. How Trusted Infrastructure Became the Lure The campaign began with fake…

Overview OpenAI has unveiled GPT‑Red, an internal automated red‑teaming model designed to identify and remediate prompt injection vulnerabilities in GPT‑5.6 Sol. This innovation addresses a growing challenge: malicious instructions hidden in third‑party content that AI systems process, such as webpages, emails, or tool outputs. What is Prompt Injection? Prompt injection occurs when attackers…

Overview Zoom has issued a critical security advisory for a vulnerability in its Windows desktop client and SDK, warning that attackers could exploit the flaw to hijack user accounts without authentication. The issue, tracked as CVE‑2026‑53412, carries a CVSS score of 9.8, making it one of the most severe vulnerabilities disclosed by the platform to date. The Vulnerability CVE‑2026‑53412 —…

Overview The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical advisory warning that attackers are actively exploiting three SharePoint Server vulnerabilities — CVE‑2026‑32201, CVE‑2026‑45659, and CVE‑2026‑56164. These flaws affect all supported on‑premises SharePoint Server versions, including the Subscription Edition, and allow attackers to bypass…

Overview Researchers at Blackpoint Cyber’s Adversary Pursuit Group (APG) have uncovered a new Rust-based remote access tool (RAT) dubbed LabubaRAT, which disguises itself as legitimate NVIDIA software to infiltrate Windows systems. Distributed as nvidia-sysruntime.exe, the malware leverages fake vendor metadata and runtime artifacts to blend into enterprise environments while granting attackers…