❌

Visualização normal

Ontem — 7 de Novembro de 2026Cybersecurity News
  • ✇Cybersecurity News
  • Penpot File Takeover Flaw Details and PoC Exploit Publicly Disclosed Do Son
    Technical details and PoC exploit code for the critical Penpot file takeover flaw are now public. Upgrade to version 2.18.0 now. Related Posts: Attackers Exploit SonicWall SonicOS SSLVPN Flaw CVE-2026-19868 in the Wild Veeam Releases Kernel Updates to Fix Critical CVE-2026-98432 Flaw Across Backup Appliances JetBrains Patches 61 Flaws Across Hub, Datalore, YouTrack, and IntelliJ IDEA The post Penpot File Takeover Flaw Details and PoC Exploit Publicly Disclosed appeared first on Daily CyberSec
     
Antes de ontemCybersecurity News
  • ✇Cybersecurity News
  • APT29 Uses Watering Holes and Plerdy Tracker to Deploy Mobile Exploits Do Son
    Sekoia uncovered an APT29 watering hole campaign mobile exploits operation using Plerdy analytics and watering holes to compromise unpatched phones. Related Posts: Suspected MuddyWater SimpleHelp Campaign Targets Israeli Organizations With Tax Lures mSecure Security Notification Prompts Password Resets Threat Actors Hijack Enterprise AI Models in Costly LLMJacking Cloud Attacks The post APT29 Uses Watering Holes and Plerdy Tracker to Deploy Mobile Exploits appeared first on Daily CyberSecurit
     
  • ✇Cybersecurity News
  • LuaJIT XLoader Infostealer Spreads via Fake Orders Do Son
    Morphisec exposes a LuaJIT XLoader infostealer campaign. Learn how the XLoader infostealer abuses JScript and shared-section injection. Related Posts: BITTER PapRAT Malware Targets South Asian Organizations Apple Mercenary Spyware Threat Prompts Global Alerts Hugging Face Malware Campaign Infects AI GPU Servers The post LuaJIT XLoader Infostealer Spreads via Fake Orders appeared first on Daily CyberSecurity.
     
  • ✇Cybersecurity News
  • SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code Do Son
    SnappyMail RCE chain disclosed with a public proof-of-concept exploit. The auth bypass hit dev builds only; avoid master builds from Oct 22-Nov 4. Related Posts: Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder PoC Exploit and Technical Details Published for Puppet Server RCE Flaw CVE-2026-115731 (CVSS 9.4) The post SnappyMail Remote Code Execution Chain Di
     
  • ✇Cybersecurity News
  • PoC Exploit and Technical Details Published for Puppet Server RCE Flaw CVE-2026-115731 (CVSS 9.4) Do Son
    Puppet Server RCE CVE-2026-115731 (CVSS 9.4) now has a public proof-of-concept exploit. Update OpenVox and Puppet Enterprise to patched versions. Related Posts: Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder The post PoC Exploit and Technical Details Published for Puppet Server
     
  • ✇Cybersecurity News
  • PoC Exploit Disclosed for macOS Privilege Escalation Do Son
    Details and a macOS privilege escalation PoC exploit are public for CVE-2026-112445. Patch macOS now to stop local users from gaining root privileges. Related Posts: Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder The post PoC Exploit Disclosed for macOS Privilege Escalation appe
     
  • ✇Cybersecurity News
  • PoC Exploit Disclosed for macOS Local Privilege Escalation Vulnerability Do Son
    Technical details and a macOS revisiond vulnerability PoC exploit for CVE-2026-112487 are public, allowing root elevation. Update macOS immediately. Related Posts: Ubuntu Kernel Fixes for CVE-2026-98432 (CVSS 9.8) Land in Proposed Pocket cPGuard Supply Chain Attack Pushes Backdoor Through Update Channel TeamViewer Client Vulnerability Enables Remote Code Execution The post PoC Exploit Disclosed for macOS Local Privilege Escalation Vulnerability appeared first on Daily CyberSecurity.
     
  • ✇Cybersecurity News
  • Public PoC Exploit Disclosed for Linux Kernel Bonding Vulnerability Do Son
    Details and a Linux kernel vulnerability PoC exploit are public for CVE-2026-31419. Patch this high-severity flaw to prevent local privilege escalation. Related Posts: Critical MediaTek Vulnerabilities Patched in Chipsets Critical FreePBX Vulnerabilities Patched in User Manager Apache Wicket Fixes 19 Vulnerabilities in 8.20.0, 9.25.0 and 10.12.0 The post Public PoC Exploit Disclosed for Linux Kernel Bonding Vulnerability appeared first on Daily CyberSecurity.
     
  • ✇Cybersecurity News
  • Reddit Mandatory Login Tests Expand to Curb AI Scraping Do Son
    Reddit is testing a Reddit mandatory login policy to thwart unauthorized AI scrapers and counteract declining organic search traffic. Related Posts: Trezor Hardware Wallet Implant Found in Reseller Units Microsoft 365 Storage Changes Reduce Family Cloud Quotas Claude CarPlay Update Adds Hands-Free AI Voice The post Reddit Mandatory Login Tests Expand to Curb AI Scraping appeared first on Daily CyberSecurity.
     
  • ✇Cybersecurity News
  • GitHub Code Activity Surges Amid AI Agent Adoption Do Son
    GitHub code activity reached historic highs in 2026, with over 7.3 billion monthly commits and 40% of pull requests drafted by AI coding agents. Related Posts: Trezor Hardware Wallet Implant Found in Reseller Units Microsoft 365 Storage Changes Reduce Family Cloud Quotas Claude CarPlay Update Adds Hands-Free AI Voice The post GitHub Code Activity Surges Amid AI Agent Adoption appeared first on Daily CyberSecurity.
     
  • ✇Cybersecurity News
  • CyberDakait Deploys Seven Android Trojan Families Against 17,960 Indian Banking Devices Do Son
    Group-IB exposes CyberDakait Android malware. The Indian CyberDakait Android malware campaign uses 7 trojans to infect 17,960 phones and steal 7.6M SMS. Related Posts: Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace INJ3CTOR3 FreePBX Malware Steals 17 Configuration Files for Off-Box Toll Fraud Qilin Ransomware Targets VMware ESXi Servers and Healthcare Networks After Claiming 900 Victims in 2026 The post CyberDakait Deploys Seven Android Trojan Families Against 17,9
     
  • ✇Cybersecurity News
  • Chained PHP2Shell Exploit Roots 25 Firewall Servers Including US Government Systems Do Son
    Dream researchers uncovered a Chinese-nexus PHP2Shell exploit Fragnesia chain that rooted 25 firewalls and breached a US government Active Directory. Related Posts: GMO Internet Ransom Demand Slashed After Cloud Breach UAT-11473 Deploys KeyDrift Malware on Cisco SD-WAN Controllers via CVE-2026-20127 Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months in US Prison The post Chained PHP2Shell Exploit Roots 25 Firewall Servers Including US Government Systems appeared first on Daily Cy
     
  • ✇Cybersecurity News
  • Public PoC Exploit Disclosed for Critical libheif RCE Vulnerabilities Do Son
    Details and PoC exploit code are out for critical libheif vulnerabilities GHSA-x8r2-mggj-j6wr and GHSA-2jg2-4ch7-h545. Upgrade to 1.23.3 now. Related Posts: Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0 The post Public PoC Exploit Disclosed for Critical libheif RCE Vulnerabilities appeared first on Dail
     
  • ✇Cybersecurity News
  • NVIDIA NeMo Agent Toolkit Vulnerability CVE-2026-65145 Scores CVSS 10.0 Do Son
    NVIDIA security update fixes NeMo Agent Toolkit vulnerability CVE-2026-65145 (CVSS 10.0) plus TensorRT-LLM and PhysX flaws. Update to 1.9.0 now. Related Posts: Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0 The post NVIDIA NeMo Agent Toolkit Vulnerability CVE-2026-65145 Scores CVSS 10.0 appeared first on
     
  • ✇Firewall Daily – The Cyber Express
  • Fake Reviews, Deceptive Ads: FTC Targets Alleged Passport Scam Samiksha Jain
    The Federal Trade Commission (FTC) has filed a complaint against GovAssist LLC, Entry LLC and Scott Zuckerman over an alleged government impersonation scheme targeting consumers seeking U.S. passport and travel-related services. The case highlights how paid search advertising, misleading service promises and allegedly fake customer reviews can be used to make commercial websites appear connected to official government services. According to the FTC, the defendants allegedly used websites and sp
     

Fake Reviews, Deceptive Ads: FTC Targets Alleged Passport Scam

23 de Outubro de 2026, 07:27

Government impersonation scheme

The Federal Trade Commission (FTC) has filed a complaint against GovAssist LLC, Entry LLC and Scott Zuckerman over an alleged government impersonation scheme targeting consumers seeking U.S. passport and travel-related services. The case highlights how paid search advertising, misleading service promises and allegedly fake customer reviews can be used to make commercial websites appear connected to official government services.

According to the FTC, the defendants allegedly used websites and sponsored search results to attract travelers, collect personal and financial information, and mislead consumers about the services they would receive. The complaint was filed in the U.S. District Court for the District of Puerto Rico.

How the Government Impersonation Scheme Allegedly Worked?

The FTC alleges that, since at least October 2023, GovAssist, Entry and Zuckerman operated websites including GovAssist.com, Entry.com and IVS.us, offering passport applications, passport-related services, visa applications and visa renewals.

The complaint states that the websites presented themselves as affiliated with the U.S. State Department, although the defendants were neither the federal government nor authorized government-affiliated providers of passport-related services.

The alleged operation relied on paid search ads to reach people looking for official passport information. Searches such as “apply for a new passport,” “passport renewal,” and “passport renewal online” routinely returned IVS.us and Entry.com pages among Google’s top sponsored results, according to the FTC.

This approach allegedly placed commercial services in locations where users might expect to find official government resources. The distinction matters because consumers searching for essential documents may not recognize that a sponsored result belongs to a private company rather than a government agency.

Misleading Passport Service Claims and Hidden Costs

The FTC alleges that the defendants made false promises about what their services could deliver, including claims that they could directly issue U.S. passports. In many cases, consumers allegedly received only a completed passport application that was available for free through the State Department’s website.

The complaint also challenges the companies’ pricing disclosures. Although their advertisements or websites reportedly stated that services started at $89, the FTC alleges that the lowest available price was $119, plus a $29 shipping fee, bringing the total to $148.

Consumers also needed to pay the State Department when submitting their passport applications. According to the complaint, the defendants prominently displayed their own prices while omitting or downplaying the additional government fee, potentially leaving customers unaware that they would have to pay again.

Delivery claims are another part of the case. The FTC alleges that the defendants advertised expedited passport services promising delivery in as little as six to 10 business days or three to four business days. The agency contends these promises were false because the timelines were faster than the quickest expedited service available through the State Department, the only source of U.S. passports.

Fake Reviews and Consumer Trust

The complaint further alleges that the defendants used fake positive reviews to make their services appear legitimate. Their websites reportedly highlighted excellent ratings based on consumer feedback published on Trustpilot and other review platforms.

According to the FTC, those ratings relied on high numbers of fake positive reviews. If established, the allegations would show how misleading reviews can reinforce the credibility created by sponsored search placements, making it harder for consumers to distinguish legitimate services from deceptive offerings.

The alleged combination of deceptive ads and fake reviews is central to the case because consumers may rely on both search rankings and customer feedback when deciding which service to trust.

FTC Alleges Violations of Three Federal Laws

The FTC alleges that the defendants violated the FTC Act, the Impersonation Rule and the Gramm-Leach-Bliley Act. The complaint targets the alleged impersonation of government services, misleading representations about passport processing and pricing, and the use of false consumer reviews.

Zuckerman, identified as the owner and sole member of GovAssist and Entry, allegedly operated the scheme while subject to an FTC order in an earlier, unrelated case involving Support King LLC. That case concerned stalkerware and resulted in a final administrative order addressing data privacy.

The FTC said its staff received assistance from the U.S. Postal Inspection Service, the U.S. Attorney’s Office for the District of Puerto Rico and the U.S. Department of State. The Commission authorized the complaint in a 2-0 vote.

What the Case Reveals About Online Consumer Fraud

The allegations illustrate how consumer fraud can exploit the gap between what users expect from an online search and what a website actually provides. A sponsored result may appear prominently, but its placement does not establish that the service is government-operated or officially authorized.

The case also highlights the role of pricing transparency and review authenticity in online trust. Claims about faster processing, low starting prices, and positive customer experiences can influence purchasing decisions, particularly when consumers need time-sensitive travel documents.

The FTC has emphasized that filing a complaint does not establish that the defendants violated the law. The case will be decided by the court.

For consumers, the allegations underscore the importance of distinguishing official government services from third-party providers and checking fees, processing claims, and reviewing credibility before sharing personal or financial information. The FTC also states that it will never demand money, threaten consumers, instruct them to transfer money, or promise them a prize.

Cloudflare
Verify you are human

loading

Checking your browser before accessing this site.
Click to verify →
Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

Cloudflare
Verify you are human
loading
Checking your browser before accessing this site.
Click to verify →
Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

  • ✇Cybersecurity News
  • cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers Do Son
    A cPanel PHP update fixes PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, while WP Toolkit 6.11.5 patches CVE-2026-107663. Related Posts: QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline Portainer Fixes Two Critical Flaws Letting Standard Users Take Over Docker Hosts Fortinet Urges Fast Upgrades as AI-Found Flaws Hit FortiOS, FortiManager and FortiAnalyzer The post cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers appeared
     
  • ✇Cybersecurity News
  • APT41 Deploys BlackX UEFI Bootkit Against Central Asian Diplomatic Agencies Do Son
    Kaspersky uncovered the BlackX UEFI bootkit APT41 campaign bypassing Secure Boot via Baton Drop to spy on Central Asian diplomatic agencies. Related Posts: APT28 Uses Hookedge Backdoor to Spy on Naval Shipbuilder and Defense Firms in Two NATO Countries China-Linked Operator Used AI Agents to Breach 48 Government and Corporate Targets Across Asia Lazarus Operation FlashHole Abuses CrossWeb EX and GitHub to Spy on South Korean Firms The post APT41 Deploys BlackX UEFI Bootkit Against Central Asi
     
  • ✇Security | CIO
  • The same AI question emits more carbon dioxide in Texas than in Sweden
    The Swedish AI company Berget AI, together with researchers from the Stockholm Environment Institute (SEI) and the organizations WattTime and Klimatkollen, has developed a new method for calculating how much carbon dioxide different AI requests generate. The aim is to make the AI ​​industry’s climate impact more transparent and give companies the opportunity to compare different suppliers. According to the method, for example, a typical request to the AI ​​model Kimi
     

The same AI question emits more carbon dioxide in Texas than in Sweden

21 de Outubro de 2026, 17:42

The Swedish AI company Berget AI, together with researchers from the Stockholm Environment Institute (SEI) and the organizations WattTime and Klimatkollen, has developed a new method for calculating how much carbon dioxide different AI requests generate.

The aim is to make the AI ​​industry’s climate impact more transparent and give companies the opportunity to compare different suppliers.

According to the method, for example, a typical request to the AI ​​model Kimi K3 results in around 0.4 grams of carbon dioxide emissions in Sweden, 1.6 grams in Ireland, 2.5 grams in Germany, and 3.2 grams in Texas. Despite identical hardware.

Berget AI has published the method as open source, meaning other companies can freely use it. A web-based calculator also makes it possible to compare emissions between different AI models and geographical regions.

  • ✇Cybersecurity News
  • Apple Blocks WebKit Identity Resolution in Privacy Shift Do Son
    Apple detailed its new WebKit identity resolution blocking update, cutting off AdTech cross-site tracking across Safari on iOS and macOS. Related Posts: Chrome ClickFix Protection Scans Risky Clipboard Commands cURL Vulnerability Reporting Policy Shifts to GitHub UK CMA Moves to Unlock iPhone Contactless Payments The post Apple Blocks WebKit Identity Resolution in Privacy Shift appeared first on Daily CyberSecurity.
     
❌
❌