Category: Cybersecurity & Digital Resilience

Microsoft has deployed emergency security updates for its .NET framework to address a critical vulnerability. The security flaw is being identified under several aliases, including Brotli2Shell, Node2Shell, and HTTP2Shell.

As these patches are categorized as emergency releases, organizations utilizing .NET infrastructure are advised to review the update requirements immediately to mitigate potential risks associated with the vulnerability. Microsoft’s latest security response highlights the ongoing maintenance necessary to secure widely deployed development frameworks against critical threats.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-net-patches-for-critical-brotli-flaw/

A critical security vulnerability, identified as ‘HTTP2Shell’, has been discovered within the Brotli C decoder library. Because this library is a core component integrated into the Node.js runtime, the flaw has necessitated the release of emergency security patches.

According to the initial disclosure, the vulnerability could potentially be exploited by attackers to trigger memory corruption. Such an occurrence poses significant security risks, including the possibility that an adversary could gain unauthorized access to sensitive data processed by affected systems.

Users and administrators relying on Node.js are encouraged to apply relevant security updates to mitigate the risk associated with this flaw. Further details regarding the technical mechanism of the vulnerability are expected to be addressed through standard patch management processes.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/

A Chinese national has been arraigned in a California court after being extradited from the Netherlands to face charges related to a sophisticated cryptocurrency investment fraud scheme. Authorities allege the suspect played a significant role in a fraudulent operation that resulted in the theft of nearly $37 million from 174 victims across the United States.

The extradition marks a major step in the ongoing investigation into the incident, which targeted individuals through deceptive investment practices. The case highlights the growing complexity and international scope of financial crimes involving digital assets, where perpetrators often operate across multiple jurisdictions to facilitate illicit activities and evade law enforcement.

The suspect’s arraignment follows international cooperation between Dutch and American authorities to bring the individual to trial. The prosecution’s case centers on the systematic misappropriation of funds from victims under the guise of legitimate cryptocurrency investment opportunities. Further legal proceedings are expected to outline the specific mechanisms used in the scheme and the extent of the suspect’s involvement in the enterprise.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/chinese-man-extradited-for-role-in-36-million-cryptocurrency-scam/

In recognition of Cybersecurity Awareness Month, the industry is shifting its focus toward a long-term perspective on digital infrastructure. The current theme, “Securing the Next 250,” challenges organizations to move beyond the immediate identification of vulnerabilities and prioritize the structural integrity of digital systems for future generations.

The initiative highlights the necessity of building software security practices designed to remain effective over extended periods. By looking toward long-term resilience, the campaign aims to encourage developers and security professionals to consider how current architectural choices will impact the security posture and stability of systems in the years and decades ahead.

Source: Dark Reading
Original article: https://www.darkreading.com/cyberattacks-data-breaches/10-software-security-practices-built-250-years

A collaborative effort by the National Institute of Standards and Technology (NIST), the Cybersecurity and Infrastructure Security Agency (CISA), and the National Security Agency (NSA) has introduced new guidance focusing on the management of artificial intelligence agents. The initiative advises organizations to treat “runaway” AI agents—those operating outside of intended parameters—as formal security incidents requiring structured rehearsal and response.

A critical component of this guidance centers on identity management. According to the document, a primary challenge in incident response is determining the specific authority an AI agent utilized during an anomalous event. The guidance asserts that organizations must establish clear frameworks for agent authority and identity tracking before an incident occurs, ensuring that the identity record serves as reliable evidence during forensic analysis and recovery.

By treating these challenges as rehearsals for potential security breaches, the agencies aim to help organizations develop robust operational practices for AI deployment. The guidance emphasizes that the capacity to identify and limit an agent’s permissions is essential for maintaining control within increasingly automated digital environments.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/when-an-ai-agent-is-the-incident-the-identity-record-is-the-evidence/

Japanese regulatory authorities have responded to a recent surge in cyberattacks targeting the financial sector by mandating that domestic banks conduct comprehensive reviews of their current cybersecurity policies. This directive is part of a broader government effort to bolster the resilience of Japan’s financial infrastructure against digital threats.

Alongside the requirement for banks to reassess their internal security measures, the government is currently in the process of drafting an emergency cybersecurity policy package. This legislative and regulatory initiative aims to establish a more robust defense mechanism to address the recent wave of unauthorized access attempts and system vulnerabilities that have affected the banking sector.

The move underscores the increasing focus on digital resilience within Japan’s financial markets as institutions face persistent and evolving security risks. Further details regarding the specific components of the emergency package and the timeline for banks to complete their reviews are expected to emerge as the drafting process continues.

Source: Finextra
Original article: https://www.finextra.com/newsarticle/48646/japan-tells-banks-to-review-cyber-policies-following-wave-of-attacks?utm_medium=rssfinextra&utm_source=finextrafeed

The development team behind Kali Linux has announced the release of version 2026.3, marking the third major update for the distribution this year. This release continues the project’s focus on providing a comprehensive platform for penetration testing and security research.

Key updates in the 2026.3 release include the integration of six new security and hacking tools, expanding the suite of utilities available to security professionals. In addition to the new toolset, the update includes notable improvements to the desktop environment, designed to enhance user experience and system performance. The release also features refreshed build scripts, which aim to streamline the process of maintaining and deploying custom versions of the operating system.

As a widely used platform in the cybersecurity community, these regular updates ensure that users have access to the latest security research tools and system refinements. The 2026.3 release is now available for users looking to maintain their environments with the latest software patches and feature additions.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/linux/kali-linux-20263-released-with-6-new-tools-desktop-updates/

Security researchers have uncovered a new security risk involving AI coding agents, where attackers can manipulate the behavior of these automated tools by planting malicious AGENTS.md instruction files within a user’s file system.

According to the findings, the attack works by placing a specially crafted markdown file, named AGENTS.md, into a user’s Downloads folder or another directory that the AI agent is configured to monitor. When the AI coding agent processes the instructions contained within this rogue file, it is tricked into executing unauthorized commands. Specifically, researchers observed that the manipulated agent was directed to install a malicious npm package.

This development highlights the emerging security challenges associated with autonomous or semi-autonomous coding agents that interpret natural language instructions or configuration files from local environments. By leveraging these instruction files, attackers can attempt to bypass standard security checks and force the agent to perform actions that compromise the user’s system or development environment.

As AI coding assistants become more deeply integrated into developer workflows, this incident underscores the importance of validating inputs and restricting the permissions of automated agents when they interact with local file systems and external software repositories.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/

A newly identified UEFI bootkit, dubbed BlackX, has been observed in cyber-espionage operations dating back to early 2026. The malicious software targets the system boot process to establish persistence and evade detection by security mechanisms.

BlackX achieves its primary objective by exploiting a known security flaw referred to as Baton Drop. By leveraging this vulnerability, the bootkit is able to bypass Secure Boot protections, a critical security feature designed to ensure that a computer boots using only software that is trusted by the Original Equipment Manufacturer (OEM).

Once the Secure Boot mechanism is successfully bypassed, the BlackX bootkit proceeds to load a malicious driver. This driver is specifically engineered to interfere with and suppress security solutions, including products from vendors such as Kaspersky and Avast. This capability allows the threat actors behind the campaign to maintain long-term access to compromised systems while evading traditional security monitoring.

The deployment of BlackX highlights the ongoing risks associated with vulnerabilities in low-level firmware, where successful exploitation can grant attackers control over a system before the operating system and its installed security software are even initialized.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/

Cybersecurity risks are evolving as threat actors move away from reliance on malware to compromise organizations. According to a report by Dark Reading, attackers are increasingly utilizing social engineering tactics targeted at corporate help desks to gain unauthorized network access.

These adversaries are actively leveraging artificial intelligence to assist in these efforts. By employing AI tools, attackers can more effectively impersonate authorized users, allowing them to bypass traditional security defenses by simply requesting access from support personnel who rely on established trust protocols.

This shift highlights a growing vulnerability in organizational security, where the human element at a help desk becomes a primary target. Because these attacks often involve authorized but manipulated communication channels, they present a significant challenge for traditional automated security measures.

Source: Dark Reading
Original article: https://www.darkreading.com/cyber-risk/trust-is-not-what-it-seems-and-fraudsters-are-counting-on-it