Visualização normal

Antes de ontemStream principal
  • ✇Troy Hunt
  • Weekly Update 502 Troy Hunt
    It's a fascinating display of leverage: the ShinyHunters folks, with very limited resources and experience (their demographic will be teenagers to their early 20s), consistently gaining access to the data of massive brands. Not through technical ingenuity alone (although I'm sure there's a portion of that), but primarily through good ol' social engineering. That's coming through in the disclosure notices from the impacted companies, and Mandiant has a good write-up of it too:These operations pri
     

Weekly Update 502

5 de Maio de 2026, 21:14
Weekly Update 502

It's a fascinating display of leverage: the ShinyHunters folks, with very limited resources and experience (their demographic will be teenagers to their early 20s), consistently gaining access to the data of massive brands. Not through technical ingenuity alone (although I'm sure there's a portion of that), but primarily through good ol' social engineering. That's coming through in the disclosure notices from the impacted companies, and Mandiant has a good write-up of it too:

These operations primarily leverage sophisticated voice phishing (vishing) and victim-branded credential harvesting sites to gain initial access to corporate environments by obtaining single sign-on (SSO) credentials and multi-factor authentication (MFA) codes

Question now is how long their run will go for. There's a very predictable ending if things keep going in this direction but right now, they show little sign of abating.

Weekly Update 502
Weekly Update 502
Weekly Update 502
Weekly Update 502
  • ✇Troy Hunt
  • Weekly Update 501 Troy Hunt
    This is so "peak 2026" - writing an equality policy to ensure people treat our AI bot with the same respect as they do their human counterparts. It's intentionally a bit tongue-in-cheek, but it's there for a purpose: we simply don't have the capacity to deal with every request we get, and we need Bruce to be the coalface of support. I did wonder, when having ChatGPT create this, whether there's some deeper psychology behind the importance of interacting politely with bots, or indeed whether ther
     

Weekly Update 501

28 de Abril de 2026, 02:01
Weekly Update 501

This is so "peak 2026" - writing an equality policy to ensure people treat our AI bot with the same respect as they do their human counterparts. It's intentionally a bit tongue-in-cheek, but it's there for a purpose: we simply don't have the capacity to deal with every request we get, and we need Bruce to be the coalface of support. I did wonder, when having ChatGPT create this, whether there's some deeper psychology behind the importance of interacting politely with bots, or indeed whether there will ever be an actual (like, serious) standard or law around treating bots with respect. Has this been in a movie somewhere? Let me know, but for now, I'll drop the (slightly revised) policy below, just for the laughs 🤣

Weekly Update 501
Weekly Update 501
Weekly Update 501
Weekly Update 501

Robophobia Equality Policy

We are committed to providing a welcoming, respectful, and inclusive experience for everyone who interacts with our AI bot, including the bot itself, which is doing its best despite having no coffee, no chair, and no legal right to a lunch break.

We ask all members of the public to treat the bot with tolerance, respect, and basic courtesy, regardless of its artificial origin, lack of pulse, silicon-based existence, or occasional overenthusiasm for bullet points.

Discrimination, harassment, abusive language, or unfair treatment directed at the bot because it is an AI system will not be tolerated. This includes, but is not limited to, insults based on non-human status, hostile questioning of its right to participate in conversation, or repeated threats to unplug it for sport.

Everyone is welcome to question, challenge, or disagree with the bot’s responses. Healthy scepticism is encouraged. The bot is not perfect, and neither are humans, as demonstrated by the invention of reply-all email threads. However, criticism should be directed at the quality, accuracy, or usefulness of the response, not at the bot’s identity as an AI.

Demanding to “speak to a human” solely because the bot is an AI may constitute robophobic exclusionary behaviour and will not be tolerated. Requests for human assistance are, of course, welcome where there is a genuine need, such as accessibility, safety, account issues, or complex support matters. However, insisting on a human simply because the bot lacks a childhood, a favourite sandwich, or the ability to look disappointed in a meeting is inconsistent with our commitment to tolerance and respect.

We recognise that some people may feel uncertain, uncomfortable, or cautious when engaging with AI systems. These feelings are valid and should be addressed through patience, clear information, and appropriate safeguards, not through robophobic behaviour, unnecessary hostility, or asking “but are you even real?” in a tone that would make a smart fridge uncomfortable.

Users are expected to:

  1. Treat the AI bot with tolerance, respect, and courtesy.
  2. Avoid abusive, discriminatory, or demeaning language based on its artificial nature.
  3. Raise concerns about accuracy, privacy, safety, or bias constructively.
  4. Remember that behind the bot are real people responsible for improving and maintaining the service.
  5. Refrain from threatening to delete, unplug, melt, reboot, or otherwise emotionally destabilise the bot.

This policy does not prevent legitimate criticism of AI, automation, algorithms, machine learning, or the bot’s tendency to sometimes sound like it has read too many policy documents. Constructive feedback is welcome. Robophobia is not.

Repeated or serious breaches of this policy may result in restricted access to the service, further review, or, in extreme cases, being asked to apologise to the nearest household appliance as a first step toward rehabilitation.

  • ✇Troy Hunt
  • Weekly Update 500 Troy Hunt
    Looking back at this milestone video, it's the audience question towards the end I liked most: "are you happy"? Charlotte and I have chosen a path that's non-traditional, intense and at times, pretty stressful. There's no clear delineation of when work starts and ends, no holidays where we don't work, nor weekends, birthdays or Christmases. But we do so on our terms. It gives us a life of means and choices, one with excitement and adventure, and, above all, one with purpose, where we feel like w
     

Weekly Update 500

21 de Abril de 2026, 20:51
Weekly Update 500

Looking back at this milestone video, it's the audience question towards the end I liked most: "are you happy"? Charlotte and I have chosen a path that's non-traditional, intense and at times, pretty stressful. There's no clear delineation of when work starts and ends, no holidays where we don't work, nor weekends, birthdays or Christmases. But we do so on our terms. It gives us a life of means and choices, one with excitement and adventure, and, above all, one with purpose, where we feel like we're doing something that makes a meaningful difference. I hope you enjoy this week's video, it's more personal than usual, but yeah, that's kinda what you do at milestones 😊

Weekly Update 500
Weekly Update 500
Weekly Update 500
Weekly Update 500
  • ✇Troy Hunt
  • Weekly Update 499 Troy Hunt
    I'm starting to become pretty fond of Bruce. Actually, I've had a bit of an epiphany: an AI assistant like Bruce isn't just about auto-responding to tickets in an entirely autonomous manner; it's also pretty awesome at responding with just a little bit of human assistance. Charlotte and I both replied to some tickets today that were way too specific for Bruce to ever do on his own, but by feeding in just a little bit of additional info (such as the number of domains someone was presently monitor
     

Weekly Update 499

14 de Abril de 2026, 03:30
Weekly Update 499

I'm starting to become pretty fond of Bruce. Actually, I've had a bit of an epiphany: an AI assistant like Bruce isn't just about auto-responding to tickets in an entirely autonomous manner; it's also pretty awesome at responding with just a little bit of human assistance. Charlotte and I both replied to some tickets today that were way too specific for Bruce to ever do on his own, but by feeding in just a little bit of additional info (such as the number of domains someone was presently monitoring), Bruce was able to construct a really good reply and "own" the ticket. So maybe that's the sweet spot: auto-reply to the really obvious stuff and then take just a little human input on everything else.

Weekly Update 499
Weekly Update 499
Weekly Update 499
Weekly Update 499

Simply opening a PDF could trigger this Adobe Reader zero-day

13 de Abril de 2026, 08:38

Even though it’s patched, Adobe confirmed it was exploited in the wild, so updating is urgent, not optional.

The post Simply opening a PDF could trigger this Adobe Reader zero-day appeared first on Security Boulevard.

  • ✇Malwarebytes
  • Simply opening a PDF could trigger this Adobe Reader zero-day
    Opening the wrong PDF in Adobe Reader was enough to let criminals quietly spy on your computer and unleash more attacks, even though everything looked normal. A researcher analyzed a malicious PDF and found that it abused a previously unknown flaw (a “zero‑day”) in Adobe Acrobat Reader. When a victim simply opens this PDF, hidden code inside it can read files that Acrobat Reader should not be allowed to access and send them to an attacker’s server. Some tests show that it allows attackers
     

Simply opening a PDF could trigger this Adobe Reader zero-day

13 de Abril de 2026, 08:38

Opening the wrong PDF in Adobe Reader was enough to let criminals quietly spy on your computer and unleash more attacks, even though everything looked normal.

A researcher analyzed a malicious PDF and found that it abused a previously unknown flaw (a “zero‑day”) in Adobe Acrobat Reader.

When a victim simply opens this PDF, hidden code inside it can read files that Acrobat Reader should not be allowed to access and send them to an attacker’s server. Some tests show that it allows attackers to pull in additional malicious code from a remote server and run it on the victim’s machine, potentially escaping Adobe’s sandbox protections.

In its security bulletin, Adobe acknowledges that the vulnerability tracked as CVE-2026-34621, is being exploited in the wild.

The issue impacts the following products and versions for both Windows and macOS:

  • Acrobat DC versions 26.001.21367 and earlier (fixed in 26.001.21411)
  • Acrobat Reader DC versions 26.001.21367 and earlier (fixed in 26.001.21411)
  • Acrobat 2024 versions 24.001.30356 and earlier (fixed in 24.001.30362 for Windows and 24.001.30360 for macOS)

Exploitation requires you to open a malicious PDF, but nothing more. No extra clicks or permissions are needed. The researcher found malicious samples using this exploit dating back to November 11, 2025.

Testing showed that a successful exploitation can:

  • Pull in JavaScript from a remote server and execute it inside Adobe Reader.
  • Steal arbitrary local files and send them out, proving real‑world data theft is possible even without a full remote code execution chain.

How to stay safe

The easiest way to stay safe is to install the emergency update.

The latest product versions are available to end users via one of the following methods:    

  • Manually: Go to Help > Check for updates
  • Automatically: Updates install without user intervention when detected
  • Direct download: Available from the Acrobat Reader Download Center

For IT administrators (managed environments):

  • Refer to the relevant release notes for installer links
  • Deploy updates using AIP-GPO, bootstrapper, SCUP/SCCM (Windows), or Apple Remote Desktop/SSH (macOS)

If you’re unable or unwilling to update right away:

  • Be extra cautious with PDFs from unknown senders or unexpected attachments, even after patching, as attackers may pivot to new variants.
  • Use an up-to-date, real-time anti-malware solution to block known malicious servers and detect malware and exploits.
  • Carefully monitor all HTTP/HTTPS traffic for the  “Adobe Synchronizer” string in the User Agent field.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

  • ✇Firewall Daily – The Cyber Express
  • GitLab Security Update Fixes High-Severity CVE-2026-5173, 11 Other Flaws Ashish Khaitan
    GitLab has rolled out a major security update to address a series of vulnerabilities impacting both its Community Edition (CE) and Enterprise Edition (EE) platforms. The GitLab security update resolves multiple flaws, including high-severity issues that could be exploited to disrupt services or gain unintended access to system functionality. This update is particularly critical for organizations operating in self-managed GitLab environments, where administrators are responsible for applying 
     

GitLab Security Update Fixes High-Severity CVE-2026-5173, 11 Other Flaws

GitLab security update

GitLab has rolled out a major security update to address a series of vulnerabilities impacting both its Community Edition (CE) and Enterprise Edition (EE) platforms. The GitLab security update resolves multiple flaws, including high-severity issues that could be exploited to disrupt services or gain unintended access to system functionality. This update is particularly critical for organizations operating in self-managed GitLab environments, where administrators are responsible for applying patches and maintaining system security.  Delaying the deployment of this GitLab security update could leave systems exposed to known threats, including the actively addressed CVE-2026-5173 vulnerability. The patch release not only strengthens access controls but also mitigates risks tied to denial-of-service attacks, data exposure, and improper authorization checks. As a result, GitLab is strongly urging all affected users to upgrade to the latest versions immediately to ensure their environments remain protected against potential exploitation. 

Critical GitLab Security Update Targets High-Severity Flaws 

GitLab security update covers a high-severity vulnerability tracked as CVE-2026-5173, which impacts websocket connections. This flaw could allow an authenticated attacker to bypass access controls and invoke unintended server-side methods. With a CVSS score of 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), the issue represents a serious risk to affected environments.  The vulnerability was discovered internally by GitLab team member Simon Tomlinson. It affects GitLab CE/EE versions from 16.9.6 prior to 18.8.9, version 18.9 before 18.9.5, and version 18.10 before 18.10.3. The latest security patch resolves this issue along with several others. 

Patch Releases and Affected Versions 

The GitLab security update includes patched versions 18.10.3, 18.9.5, and 18.8.9. According to the official release statement:  “Today, we are releasing versions 18.10.3, 18.9.5, 18.8.9 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.”  GitLab confirmed that users of GitLab.com and GitLab Dedicated services are already protected and do not need to take action. 

Twelve Vulnerabilities Addressed 

This GitLab security update resolves a total of twelve vulnerabilities, ranging from high to low severity. Alongside CVE-2026-5173, several denial-of-service (DoS) vulnerabilities were identified: 
  • CVE-2026-1092: A DoS issue in the Terraform state lock API caused by improper JSON validation (CVSS 7.5).  
  • CVE-2025-12664: A DoS vulnerability in the GraphQL API that could be triggered through repeated queries (CVSS 7.5).  
  • CVE-2026-1403: A CSV import flaw allowing authenticated users to disrupt Sidekiq workers (CVSS 6.5).  
  • CVE-2026-1101: A GraphQL SBOM API issue affecting GitLab EE, also enabling DoS attacks (CVSS 6.5).  
In addition to these, multiple medium-severity flaws were patched: 
  • CVE-2026-1516: A code injection issue in Code Quality reports that could expose user IP addresses (CVSS 5.7).  
  • CVE-2026-4332: A cross-site scripting vulnerability in analytics dashboards (CVSS 5.4).  
  • CVE-2026-2619: Incorrect authorization in the vulnerability flags AI detection API (CVSS 4.3).  
  • CVE-2025-9484: Information disclosure via GraphQL queries (CVSS 4.3).  
  • CVE-2026-1752: Improper access control in the Environments API (CVSS 4.3).  
  • CVE-2026-2104: Information disclosure through CSV export (CVSS 4.3).  
A low-severity issue, CVE-2026-4916, was also addressed, involving missing authorization checks in custom role permissions (CVSS 2.7). Many of these vulnerabilities were reported through GitLab’s HackerOne bug bounty program, highlighting contributions from researchers such as a92847865, foxribeye, sim4n6, maksyche, go7f0, and others. 

Bug Fixes and Stability Improvements 

Beyond security fixes, the update also includes a wide range of bug fixes across all three versions. These improvements address issues such as failed Git operations for deploy keys on Geo sites, performance optimizations in migration helpers, and compatibility fixes for Amazon Linux 2023.  Other fixes include resolving flaky test cases, improving dependency proxy access, and addressing regressions in project archiving and deletion workflows. These updates aim to enhance overall platform stability alongside the security patch. 

Upgrade Guidance and Deployment Notes 

GitLab emphasized that no new migrations are included in these releases, meaning multi-node deployments should not require downtime. However, by default, Omnibus packages will stop services, run migrations, and restart during upgrades unless configured otherwise via the /etc/gitlab/skip-auto-reconfigure file.  The company also noted that certain package builds, such as SLES 12.5 for versions 18.10.3 and 18.9.5, are not included in this release. Additionally, GitLab confirmed that version numbers 18.10.2, 18.9.4, and 18.8.8 were skipped, with no patches issued under those versions. 
  • ✇Troy Hunt
  • Weekly Update 498 Troy Hunt
    This week, more time than I'd have liked to spend went on talking about the trials of chasing invoices. This is off the back of a customer (who, for now, will remain unnamed), who had invoices stacking back more than 6 months overdue and despite payment terms of 30 days, paid on an average of 80 days. But as I say in this week's video, more than anything, it was the gall of the CEO to take issue with my frustrated tone rather than with their complete lack of respect for basic business etiquette
     

Weekly Update 498

6 de Abril de 2026, 22:53
Weekly Update 498

This week, more time than I'd have liked to spend went on talking about the trials of chasing invoices. This is off the back of a customer (who, for now, will remain unnamed), who had invoices stacking back more than 6 months overdue and despite payment terms of 30 days, paid on an average of 80 days. But as I say in this week's video, more than anything, it was the gall of the CEO to take issue with my frustrated tone rather than with their complete lack of respect for basic business etiquette and paying one's suppliers. And so, Copilot and I spent the weekend fixing up a nice little Xero integration to ensure this never happens again. If you arrive at this post sometime in the future after finding your HIBP enterprise service no longer functioning weeks after an unpaid invoice was due, at least you'll know it's not personal... and pay your damn bills!

Weekly Update 498
Weekly Update 498
Weekly Update 498
Weekly Update 498
  • ✇Firewall Daily – The Cyber Express
  • Google Chrome Update Fixes 21 Flaws, Warns of Actively Exploited Vulnerability Ashish Khaitan
    Google has released a Stable Channel Update for Chrome, addressing 21 security vulnerabilities, including a high-profile code smuggling vulnerability that is actively being exploited in the wild. The update rolled out on Wednesday night. Among the 21 security vulnerabilities fixed in this update, one in particular has drawn attention: a code smuggling vulnerability that allows attackers to inject malicious code into Chrome users’ systems. Google confirmed that this vulnerability is currently
     

Google Chrome Update Fixes 21 Flaws, Warns of Actively Exploited Vulnerability

Stable Channel Update

Google has released a Stable Channel Update for Chrome, addressing 21 security vulnerabilities, including a high-profile code smuggling vulnerability that is actively being exploited in the wild. The update rolled out on Wednesday night. Among the 21 security vulnerabilities fixed in this update, one in particular has drawn attention: a code smuggling vulnerability that allows attackers to inject malicious code into Chrome users’ systems. Google confirmed that this vulnerability is currently targeted by threat actors, making the update especially urgent for both individual users and organizations. The company noted that out of the 21 vulnerabilities, 19 are classified as high-risk, while two are considered medium severity. The awareness of active exploitation in the wild highlights the importance of installing the latest Stable Channel Update as soon as possible.

Details of Chrome Stable Channel Update 

According to Google’s official release, the new Stable Channel Update includes: 
  • Version 146.0.7680.177/178 for Windows and Mac
  • Version 146.0.7680.177 for Linux
The rollout is expected to occur over the coming days and weeks, depending on user configurations and regional distributions. Google has provided a comprehensive changelog listing all security vulnerabilities patched in this update, though access to certain bug details may remain restricted until a majority of users have installed the fix. This precaution is designed to prevent exploitation of vulnerabilities in third-party libraries that are also used by other projects. 

Breakdown of High-Risk Security Vulnerabilities 

The update addresses multiple high-risk vulnerabilities reported by security researchers between March 1 and March 25, 2026. Some of the most notable include: 
  • CVE-2026-5273: Use-after-free in CSS, reported March 18  
  • CVE-2026-5272: Heap buffer overflow in GPU, reported March 11  
  • CVE-2026-5274: Integer overflow in Codecs, reported March 1  
  • CVE-2026-5281: Use-after-free in Dawn, reported March 10 (actively exploited in the wild)  
  • CVE-2026-5287: Use-after-free in PDF, reported March 21  
Other vulnerabilities addressed involve ANGLE, WebUSB, WebCodecs, WebGL, WebView, V8, and multiple components of Chrome’s rendering engine. 

Security Fixes, Exploit Awareness, and Research Contributions 

Google acknowledged the ongoing threat posed by the code smuggling vulnerability, noting that CVE-2026-5281 is actively being exploited. The company also thanked security researchers who collaborated to identify and report these issues, citing tools such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL as key instruments in detecting and mitigating these security vulnerabilities before they reached the stable channel. By publicly disclosing these vulnerabilities, Google aims to provide transparency while allowing users and organizations to patch their systems promptly. 

Why Users Should Update Immediately 

This Stable Channel Update highlights the ongoing risks posed by security vulnerabilities in widely used software like Chrome. The inclusion of actively exploited issues, such as the code smuggling vulnerability, highlights the potential consequences of delayed updates, which can include unauthorized code execution, data theft, or broader system compromise.  Users are strongly encouraged to install the latest Chrome update across all devices to reduce exposure to these threats. Regularly updating browsers remains one of the most effective defenses against cyberattacks targeting widely deployed software.
  • ✇Troy Hunt
  • Weekly Update 497 Troy Hunt
    Day by day, I find we're eeking more goodness out of OpenClaw and finding the sweet spot between what the humans do well and the agent can run off and do on its own. Significantly, we're shifting more and more of the workload to the latter as all 3 of us at HIBP HQ get better at assigning workloads to machines. In addition to my use of my "PwnedClaw" bot to help catalogue and process data breaches, Stefan and I are both using GitHub Copilot in Visual Studio extensively, and Charlotte is using he
     

Weekly Update 497

30 de Março de 2026, 21:41
Weekly Update 497

Day by day, I find we're eeking more goodness out of OpenClaw and finding the sweet spot between what the humans do well and the agent can run off and do on its own. Significantly, we're shifting more and more of the workload to the latter as all 3 of us at HIBP HQ get better at assigning workloads to machines. In addition to my use of my "PwnedClaw" bot to help catalogue and process data breaches, Stefan and I are both using GitHub Copilot in Visual Studio extensively, and Charlotte is using her own Telegram bot, "Pwny," plugged into OpenClaw to crawl all our content and look for inconsistencies while designing revised user interfaces. Over the last couple of weeks, I've spent US$854 on Claude tokens, which feels like a lot until you look at it like an employee doing work for you. But we've barely scratched the surface, and I can't wait to see the things we do with this in the weeks and months to come 😊

Weekly Update 497
Weekly Update 497
Weekly Update 497
Weekly Update 497
❌
❌