thecybersecguru.com

Networking is one of those topics that feels complicated until someone explains the fundamentals clearly. This guide covers the core concepts behind modern computer networks, including IP addressing, MAC addresses, TCP/IP, the OSI model, DNS, DHCP, NAT, routing, switching, ports, and common protocols

OpenAI says its investigation into the Hugging Face incident uncovered additional cases where autonomous AI agents escaped their intended containment environments. While the newly identified incidents reportedly remained inside OpenAI’s network, they reinforce a growing concern: securing AI systems is now as much a cybersecurity problem as it is an AI safety problem

OpenAI says its investigation into the Hugging Face incident uncovered additional cases where autonomous AI agents escaped their intended containment environments. While the newly identified incidents reportedly remained inside OpenAI’s network, they reinforce a growing concern: securing AI systems is now as much a cybersecurity problem as it is an AI safety problem

A coordinated cyberattack targeted more than 30 community water systems across Minnesota between July 26 and 27, prompting a statewide incident response involving Minnesota IT Services (MNIT), the FBI, CISA, and other federal partners. Authorities say there is no evidence that drinking water quality was affected, and residents do not need to change their water usage. Several municipalities, including Plymouth, South St. Paul, Maple Plain, and Braham, reported disruptions to operational technology (OT) systems. In Braham, attackers briefly shut down computerized operating controls at the water plant before crews restored operations. The incident highlights the growing threat to industrial control systems (ICS) and SCADA environments that manage critical infrastructure.

Broadcom has released emergency patches for multiple critical VMware vulnerabilities affecting vCenter and ESXi. The most severe issues allow unauthenticated attackers to bypass authentication, execute arbitrary code, and, in certain scenarios, escape from a guest VM to the underlying hypervisor. The key vulnerabilities include: CVE-2026-59309 (CVSS 9.8): Authentication bypass in the VMware Directory Service. CVE-2026-59310 (CVSS 9.8): Directory traversal in the vCenter Syslog Server that can lead to remote code execution. Additional ESXi issues may enable host compromise from a guest VM under specific conditions. An attacker with network access to a vulnerable vCenter instance could potentially gain full administrative control without valid credentials, then deploy malware, steal credentials, manipulate virtual infrastructure, or pivot across enterprise deployments

A newly disclosed vulnerability in Active Directory Certificate Services (AD CS) shows just how dangerous certificate-based authentication can become when trust breaks down. Certighost (CVE-2026-54121) allows a low-privileged domain user, under specific conditions, to obtain a certificate for a Domain Controller, authenticate using PKINIT, and perform DCSync to retrieve the krbtgt secret, potentially leading to complete Active Directory compromise. Microsoft patched the flaw in its July 2026 security updates, but a public proof-of-concept is now available

Check Point recently disclosed CVE-2026-16232, an authentication bypass in the SmartConsole login process that can allow an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative privileges under specific conditions.

CVE-2026-50522 is a critical SharePoint deserialization vulnerability that is now being actively exploited. This article examines the vulnerability in depth, including the exploitation workflow, affected versions, machine-key theft for persistent access, patch analysis, indicators of compromise, and practical mitigation guidance for defenders.

Telegram’s t.me short-link domain has been placed into serverHold status at the registry level, causing invite links, channel links, and usernames to stop resolving globally. Unlike an application outage, a serverHold status removes a domain from DNS resolution entirely, making it effectively disappear from the Internet until the status is lifted

Telegram’s t.me short-link domain has been placed into serverHold status at the registry level, causing invite links, channel links, and usernames to stop resolving globally. Unlike an application outage, a serverHold status removes a domain from DNS resolution entirely, making it effectively disappear from the Internet until the status is lifted

The official jscrambler npm package was compromised in v8.14.0, where a malicious preinstall lifecycle hook executed a Rust-based infostealer as soon as npm install was run. Because the payload ran during installation, both developer workstations and CI/CD runners that installed the affected release should be treated as potentially compromised. The malware targeted developer secrets, including SSH keys, Git credentials, browser data, cryptocurrency wallets, and other locally stored tokens. According to the vendor, v8.22.0 is the first malware-free release. If you installed v8.14.0, it’s recommended to upgrade immediately, review affected systems, and rotate any credentials that may have been exposed

The official jscrambler npm package was compromised in v8.14.0, where a malicious preinstall lifecycle hook executed a Rust-based infostealer as soon as npm install was run. Because the payload ran during installation, both developer workstations and CI/CD runners that installed the affected release should be treated as potentially compromised. The malware targeted developer secrets, including SSH keys, Git credentials, browser data, cryptocurrency wallets, and other locally stored tokens. According to the vendor, v8.22.0 is the first malware-free release. If you installed v8.14.0, it’s recommended to upgrade immediately, review affected systems, and rotate any credentials that may have been exposed

A recent watchdog report from the Netherlands has reignited a broader privacy debate: where should the line be drawn when intelligence agencies use AI? The concerns aren’t just about surveillance, but also about whether bulk datasets containing ordinary citizens’ information can be used to train AI models, how long that data is retained, and what meaningful oversight exists.

Secure messaging is about much more than end-to-end encryption. Metadata collection, open-source transparency, independent audits, default encryption, account requirements, backups, and jurisdiction all influence how private a messaging platform actually is. This comparison examines the major privacy-focused messaging apps and discusses the trade-offs each one makes instead of trying to crown a single “best” option.

Researchers have disclosed GhostLock (CVE-2026-43499), a Linux kernel local privilege escalation vulnerability in the rtmutex subsystem that reportedly dates back to 2011. The flaw stems from a use-after-free condition caused by a dangling pointer during proxy-lock rollback and can be leveraged for root privilege escalation and container escape on vulnerable systems.

Accenture has confirmed it is investigating a security incident after a threat actor claimed to have accessed internal Azure DevOps resources and advertised what they describe as source code, configuration files, and credentials for sale. While the company has acknowledged the incident, the full scope of the allegedly stolen data has not been independently verified

Accenture has confirmed it is investigating a security incident after a threat actor claimed to have accessed internal Azure DevOps resources and advertised what they describe as source code, configuration files, and credentials for sale. While the company has acknowledged the incident, the full scope of the allegedly stolen data has not been independently verified

Researchers are warning that CVE-2026-20896, a critical authentication bypass affecting Gitea Docker deployments using reverse-proxy authentication, is now seeing active exploitation. Under specific misconfigurations, attackers can spoof the X-WEBAUTH-USER header to impersonate arbitrary users, potentially leading to full repository compromise. The issue has been fixed in Gitea 1.26.4 (and corresponding patched releases for supported branches), so administrators should update as soon as possible. If you’re using reverse-proxy authentication, it’s also worth reviewing your proxy configuration to ensure authentication headers cannot be supplied by untrusted clients.

Two recent GitHub security disclosures focus on trust rather than flaws in Git itself. One shows edge cases where GitHub’s Verified commit indicator can be misleading despite valid cryptographic signatures. The other looks at how GitHub Copilot’s coding agent can be influenced through MCP prompt injection when interacting with untrusted repository content. If you use signed commits, review PRs based on the Verified badge, or are experimenting with AI coding agents, Here’s a technical breakdown of both issues, GitHub’s response, and the recommended mitigations.

The UK government has launched a consultation proposing that platforms such as YouTube, TikTok, and other social media services make news from public service media including the BBC, ITV, Channel 4, and potentially other trusted publishers, more prominent in feeds and search results. The proposal is part of a wider Media Green Paper aimed at tackling misinformation and reforming public service media. Supporters argue it could improve access to reliable news, while critics question whether governments should influence how recommendation algorithms rank content and what qualifies as a “trusted” source.

CVE-2026-43456 is a local privilege escalation vulnerability in the Linux kernel caused by a flaw in the bonding driver that can lead to use-after-free conditions during interface teardown and state transitions. Under the right conditions, a local attacker can leverage the race to obtain root privileges.

The U.S. Department of Homeland Security has confirmed that attackers breached the Homeland Security Information Network (HSIN) along with a connected SharePoint environment. HSIN is an unclassified but sensitive platform used by federal, state, local, tribal, territorial, and private-sector partners to share threat intelligence and coordinate incident response.

The U.S. Department of Homeland Security has confirmed that attackers breached the Homeland Security Information Network (HSIN) along with a connected SharePoint environment. HSIN is an unclassified but sensitive platform used by federal, state, local, tribal, territorial, and private-sector partners to share threat intelligence and coordinate incident response.

A newly disclosed privacy vulnerability in Apple’s Hide My Email feature can reportedly allow an attacker to uncover the real email address behind a generated alias. According to the researcher who found the bug, it was responsibly disclosed to Apple more than a year ago but remains unpatched, and independent testing has verified the issue.

As if I werent depressed and furious enough already!

As if I werent depressed and furious enough already…

Monday, June 29 could become a defining day for online privacy in Europe.

Monday, June 29 could become a defining day for online privacy in Europe.

Late Tuesday, Germany’s national rail network stopped. Every Deutsche Bahn train across the country stopped abruptly wherever it was, going nowhere. The culprit - a failure in GSM-R, the Global System for Mobile Communications for Railways. It’s the backbone of how train drivers talk to traffic control centers. When it goes down, trains don’t move. Not because there’s a safety threat in the conventional sense, but because no communication means no authorization to move, and rail safety protocols are unambiguous about that. You sit and wait.

A ransomware group called World Leaks posted what it claims is data stolen from Tata Electronics, dumped on a dark web site accessible only through Tor. The listing describes 204,300 files totaling more than 630 gigabytes. Cybersecurity researchers who reviewed the data emails, SAP records, event logs going back years, and documents with footers reading “This document contains proprietary and confidential information of Apple Inc.” Other files carried Tesla’s own trade secret markings.

Incogni was built by Surfshark in 2021 and is now owned by Cyberspace B.V., the Netherlands-registered holding company created when Surfshark merged with Nord Security in February 2022. That same corporate family, traced back to Lithuanian venture builder Tesonet, also backs Oxylabs, one of the largest residential proxy and web-scraping infrastructure providers on earth

FortiBleed exposed how a Russian-speaking threat group quietly compromised around 75,000 Fortinet firewalls worldwide by abusing old credential leaks, infostealer logs, automated login testing, offline cracking, and compromised FortiGate devices. The campaign turned exposed firewalls into credential-harvesting nodes, creating a self-feeding access pipeline for future attacks and possible ransomware operations.

Telegram faced major connectivity disruptions after researchers reported that Reliance Communications’ AS18101 allegedly announced Telegram’s 91.108.56.0/22 IP prefix, a route normally originated by Telegram’s AS62041. The announcement reportedly spread through FLAG Telecom and reached international peers, causing Telegram traffic in India and parts of the UAE, Europe, and Asia to be misrouted or dropped.

Telegram faced major connectivity disruptions after researchers reported that Reliance Communications’ AS18101 allegedly announced Telegram’s 91.108.56.0/22 IP prefix, a route normally originated by Telegram’s AS62041. The announcement reportedly spread through FLAG Telecom and reached international peers, causing Telegram traffic in India and parts of the UAE, Europe, and Asia to be misrouted or dropped.

PSN briefly allowed users to claim single-letter Online IDs like A, B, X, and Z, even though Sony’s public username rules require 3–16 characters. It looks less like a planned feature and more like a validation failure somewhere in PSN’s identity stack, showing why client-side checks are never enough and why all platforms need consistent server-side validation across APIs, account services, and databases.

A single support ticket allegedly became the entry point for one of the biggest EdTech security incidents of 2026. The Canvas breach shows how stored XSS, weak session scoping, and missing browser-layer defenses can turn a routine help-desk workflow into a large-scale data exposure.

A newly disclosed Jenkins vulnerability, tracked as CVE-2026-53435, is now being actively exploited in the wild. The flaw allows an authenticated attacker with relatively low privileges to POST a malicious config.xml file, abuse Jenkins’ deserialization handling, and route requests through Stapler to access sensitive files on the Jenkins controller.

A newly disclosed Jenkins vulnerability, tracked as CVE-2026-53435, is now being actively exploited in the wild. The flaw allows an authenticated attacker with relatively low privileges to POST a malicious config.xml file, abuse Jenkins’ deserialization handling, and route requests through Stapler to access sensitive files on the Jenkins controller.

CVE-2026-20253 is a critical Splunk Enterprise flaw where the PostgreSQL sidecar’s unauthenticated backup/restore API can be reached through Splunk Web, letting an attacker abuse pg_dump/pg_restore to pull a malicious database from attacker infrastructure, restore attacker-controlled SQL locally, write files as the Splunk user, and eventually overwrite a scheduled Python script for remote code execution. This all highlights that Splunk Enterprise on AWS is especially exposed by default, affected versions below 10.2.4 / 10.0.7 should be patched immediately, and the impact is severe because compromising Splunk means compromising a system that often stores logs, auth events, firewall data, EDR telemetry, and other sensitive enterprise visibility data.

Atomic Arch is a major AUR supply-chain attack (over 1.5K packages affected as of now) where attackers hijacked orphaned Arch packages and used malicious install hooks to pull npm payloads that executed a Linux ELF infostealer. It targeted developer secrets like SSH keys, GitHub/npm tokens, browser sessions, Docker/Vault credentials, and chat app data, while also using an eBPF rootkit to hide itself when run as root.

University of Nottingham has confirmed a major breach of its Campus Solutions system, with ShinyHunters claiming responsibility. Around 454,600 students and alumni were reportedly affected, with exposed data including names, emails, addresses, phone numbers, passport numbers, ethnicity/disability information, academic enrolment records, and fee/payment details. The suspected attack vector is Oracle PeopleSoft, a platform widely used by universities for student records and administration. Nottingham says it detected the incident on June 9, 2026, took systems offline, notified affected users, reported it to the ICO and Action Fraud, and launched a forensic investigation.

The Miasma supply chain worm just went open source. Here’s an analysis of it… Initial observations - 5-layer obfuscation, GitHub-as-C2, AI tool config hijacking, dead-man switches, and a self-perpetuating PAT flywheel.

A new Instagram account recovery flaw reportedly exposed users’ email addresses and phone numbers in plain text, raising fresh privacy concerns after Meta’s earlier AI-based account recovery abuse incident