Author | Lightnews

Spoofed AI sidebars can trick Atlas, Comet users into dangerous actions

BolhaSec @bolhasec.com · 1h

Notícia da BleepingComputer

"Spoofed AI sidebars can trick Atlas, Comet users into dangerous actions" #bolhasec

OpenAI's Atlas and Perplexity's Comet browsers are vulnerable to AI sidebar spoofing attacks that mislead users into following fake AI-generated instructions.

Lanscope Endpoint Manager Zero-Day Exploited in the Wild

BolhaSec @bolhasec.com · 2h

Notícia da SecurityWeek

"Lanscope Endpoint Manager Zero-Day Exploited in the Wild" #bolhasec

Motex released urgent patches for a critical vulnerability in Lanscope Endpoint Manager that has been exploited in the wild as a zero-day.

Microsoft: Windows 11 Media Creation Tool broken on Windows 10 PCs

BolhaSec @bolhasec.com · 3h

Notícia da BleepingComputer

"Microsoft: Windows 11 Media Creation Tool broken on Windows 10 PCs" #bolhasec

Microsoft says the latest version of the Windows 11 Media Creation Tool (MCT) no longer works correctly on Windows 10 22H2 computers.

X: Re-enroll 2FA security keys by November 10 or get locked out

BolhaSec @bolhasec.com · 4h

Notícia da BleepingComputer

"X: Re-enroll 2FA security keys by November 10 or get locked out" #bolhasec

X is warning that users must re-enroll their security keys or passkeys for two-factor authentication (2FA) before November 10 or they will be locked out of their accounts until they do so.

SolarWinds releases third patch to fix Web Help Desk RCE bug

BolhaSec @bolhasec.com · 13h

Notícia da BleepingComputer

"SolarWinds releases third patch to fix Web Help Desk RCE bug" #bolhasec

SolarWinds has released a hotfix for a critical a critical vulnerability in Web Help Desk that allows remote code execution (RCE) without authentication.

Critical WSUS flaw in Windows Server now exploited in attacks

BolhaSec @bolhasec.com · 14h

Notícia da BleepingComputer

"Critical WSUS flaw in Windows Server now exploited in attacks" #bolhasec

Attackers are now exploiting a critical-severity Windows Server Update Services (WSUS) vulnerability, which already has publicly available proof-of-concept exploit code.

Frederick Health data breach impacts nearly 1 million patients

BolhaSec @bolhasec.com · 15h

Notícia da BleepingComputer

"Frederick Health data breach impacts nearly 1 million patients" #bolhasec

A ransomware attack in January at Frederick Health Medical Group, a major healthcare provider in Maryland, has led to a data breach affecting nearly one million patients.

Hackers exploited Zimbra flaw as zero-day using iCalendar files

BolhaSec @bolhasec.com · 16h

Notícia da BleepingComputer

"Hackers exploited Zimbra flaw as zero-day using iCalendar files" #bolhasec

Researchers monitoring for larger .ICS calendar attachments found that a flaw in Zimbra Collaboration Suite (ZCS) was used in zero-day attacks at the beginning of the year.

Oracle silently fixes zero-day exploit leaked by ShinyHunters

BolhaSec @bolhasec.com · 17h

Notícia da BleepingComputer

"Oracles silently fixes zero-day exploit leaked by ShinyHunters" #bolhasec

Oracle has silently fixed an Oracle E-Business Suite vulnerability (CVE-2025-61884) that was actively exploited to breach servers, with a proof-of-concept exploit publicly leaked by the ShinyHunters e...

North Korean Cryptocurrency Thieves Caught Hijacking Zoom ‘Remote Control’ Feature

1 2

BolhaSec @bolhasec.com · 18h

Notícia da SecurityWeek

"North Korean Cryptocurrency Thieves Caught Hijacking Zoom ‘Remote Control’ Feature" #bolhasec

North Korean cryptocurrency thieves abusing Zoom Remote collaboration feature to target cryptocurrency traders with malware.

NVIDIA shares guidance to defend GDDR6 GPUs against Rowhammer attacks

BolhaSec @bolhasec.com · 19h

Notícia da BleepingComputer

"NVIDIA shares guidance to defend GDDR6 GPUs against Rowhammer attacks" #bolhasec

NVIDIA is warning users to activate System Level Error-Correcting Code mitigation to protect against Rowhammer attacks on graphical processors with GDDR6 memory.

Advertising giant Dentsu reports data breach at subsidiary Merkle

BolhaSec @bolhasec.com · 20h

Notícia da BleepingComputer

"Advertising giant Dentsu reports data breach at subsidiary Merkle" #bolhasec

Japanese advertising giant Dentsu has disclosed that its U.S.-based subsidiary Merkle suffered a cybersecurity incident that exposed staff and client data.

Gmail business users can now send encrypted emails to anyone

BolhaSec @bolhasec.com · 21h

Notícia da BleepingComputer

"Gmail business users can now send encrypted emails to anyone" #bolhasec

Google says that Gmail enterprise users can now send end-to-end encrypted emails to people who use any email service or platform.

FIN6 hackers pose as job seekers to backdoor recruiters’ devices

1 1

BolhaSec @bolhasec.com · 22h

Notícia da BleepingComputer

"FIN6 hackers pose as job seekers to backdoor recruiters’ devices" #bolhasec

In a twist on typical hiring-related social engineering attacks, the FIN6 hacking group impersonates job seekers to target recruiters, using convincing resumes and phishing sites to deliver malware.

Mobile Security: Verizon Says Attacks Soar, AI-Powered Threats Raise Alarm

BolhaSec @bolhasec.com · 23h

Notícia da SecurityWeek

"Mobile Security: Verizon Says Attacks Soar, AI-Powered Threats Raise Alarm" #bolhasec

Verizon published its 2025 Mobile Security Index, which shows that 85% of organizations believe mobile device attacks are on the rise.

Apple Unveils iPhone Memory Protections to Combat Sophisticated Attacks

BolhaSec @bolhasec.com · 1d

Notícia da SecurityWeek

"Apple Unveils iPhone Memory Protections to Combat Sophisticated Attacks" #bolhasec

Apple's iPhone 17 and iPhone Air include a new memory protection feature to safeguard devices against sophisticated spyware attacks.

Oracle silently fixes zero-day exploit leaked by ShinyHunters

BolhaSec @bolhasec.com · 1d

Notícia da BleepingComputer

"Oracle silently fixes zero-day exploit leaked by ShinyHunters" #bolhasec

Oracle has silently fixed an Oracle E-Business Suite vulnerability (CVE-2025-61884) that was actively exploited to breach servers, with a proof-of-concept exploit publicly leaked by the ShinyHunters e...

Jaguar Land Rover Says Shutdown Will Continue Until at Least Oct 1 After Cyberattack

1 1

BolhaSec @bolhasec.com · 1d

Notícia da SecurityWeek

"Jaguar Land Rover Says Shutdown Will Continue Until at Least Oct 1 After Cyberattack" #bolhasec

Jaguar Land Rover said that its production lines, shut down after a cyberattack in August, will remain at a halt until at least Oct. 1, 2025.

Hackers ramp up scans for leaked Git tokens and secrets

BolhaSec @bolhasec.com · 1d

Notícia da BleepingComputer

"Hackers ramp up scans for leaked Git tokens and secrets" #bolhasec

Threat actors are intensifying internet-wide scanning for Git configuration files that can reveal sensitive secrets and authentication tokens used to compromise cloud services and source code reposito...

Fraud Prevention Firm Resistant AI Raises $25 Million

BolhaSec @bolhasec.com · 1d

Notícia da SecurityWeek

"Fraud Prevention Firm Resistant AI Raises $25 Million" #bolhasec

Resistant AI has announced raising $25 million in Series B funding, bringing the total raised by the company to over $55 million.

Russian Government Now Actively Managing Cybercrime Groups: Security Firm

Reposted by BolhaSec

CyberTaters @potato.software · 1d

Notícia da SecurityWeek

"Russian Government Now Actively Managing Potatocrime Groups: Security Firm" #bolhasec

2

BolhaSec @bolhasec.com · 1d

Notícia da SecurityWeek

"Russian Government Now Actively Managing Cybercrime Groups: Security Firm" #bolhasec

Russian cybercriminals are no longer just tolerated by the country’s government, but managed by it, Recorded Future reports.

Sublime Security Raises $150 Million for Email Security Platform

BolhaSec @bolhasec.com · 1d

Notícia da SecurityWeek

"Sublime Security Raises $150 Million for Email Security Platform" #bolhasec

Sublime Security has raised $150 million in a Series C funding round, which brings the total raised by the company to more than $240 million.

South Korea Seeks to Arrest Dozens of Online Scam Suspects Repatriated From Cambodia

BolhaSec @bolhasec.com · 1d

Notícia da SecurityWeek

"South Korea Seeks to Arrest Dozens of Online Scam Suspects Repatriated From Cambodia" #bolhasec

Authorities seek to arrest most of the 64 South Koreans repatriated from Cambodia for working for online scam operations in Cambodia.