Aggregator

A new macOS malware that was undocumented previously, is quietly tricking users through fake Cloudflare human verification pages. Called Infiniti Stealer, this threat uses a well-known social engineering trick called ClickFix to convince Mac users into running dangerous commands directly on their own machines, bypassing the need for any software vulnerability or exploit. For a […]

The post Fake Cloudflare CAPTCHA Pages Spread Infiniti Stealer Malware on macOS Systems appeared first on Cyber Security News.

据 Censor.NET 报道：
在乌克兰国防企业 TechEx 某分部的一位总工程师办公室内，发现了属于俄罗斯情报部门的窃听设备。TechEx 是一家专门从事各类无人机制造的企业。业内人士发出警告：所有乌克兰军工人员均已处于俄罗斯情报部门的监视之下。
该企业随后向内部成员发布了声明，声明中写道：：
“乌克兰军工人员们，请做好准备。敌人正在后方进行‘狩猎’。今天上午，我们在公司某分部的总工程师办公室内查获了俄罗斯情报部门的专用设备。是的，其中也包括‘窃听装置’。”
“得益于乌克兰国家安全局（SBU）反间谍部门与我司团队的通力协作，我们成功阻止了敏感信息的泄露，保护了生产设施，并确保了关键数据的安全。此外，我们长期以来还实施了一系列旨在对敌方进行反情报误导的措施。”
“但我们特别难以接受这样一个事实：克格勃（KGB）那一套手段竟然依然奏效，且行之有效。敌人正在玩一场卑鄙且极具专业水准的博弈，仅凭我们自身的力量已显得捉襟见肘。我们的安全防护体系虽设有多个层级，涵盖了所有最新的技术更新，并辅以持续的人员安全教育工作；但毕竟我们并非专业的反间谍机构，自然也无法拥有像他们那样充裕的资源与手段。”
声明中还写道：
“我们要向乌克兰国家安全局反间谍部门的工作人员致以诚挚的谢意！今天我们成功揭露了敌人的行径，但我们也深知，这绝非敌方的最后一次尝试。所有的乌克兰军火制造商——包括他们的技术、员工、供应商及生产设施——均已处于俄罗斯情报部门的‘监视瞄准’之下。”
“我们呼吁加强国防企业的资料保护工作，呼吁同行们切勿拖延，务必“仔细排查”，开展额外的安全检查，并更新人员的访问权限级别。遗憾的是，类似的“意外状况”很可能已潜伏在您的办公场所之中。我们乐于分享自身的经验，欢迎随时与我们联系；因为我们所有人都在为着同一个目标而奋斗——即乌克兰的最终胜利。”
一个带有黑色幽默的补充消息是：
这位总工萨多维（Sadovyi）表示——在“窃听器”被发现之前，他曾在该办公室接待过斯维里登科（Svyrydenko）、斯特凡丘克（Stefanchuk）以及多个外国代表团。

A newly analyzed local privilege escalation vulnerability in the Windows Error Reporting (WER) service allows attackers to easily gain full SYSTEM access. The flaw, tracked as CVE-2026-20817, was considered so structurally dangerous that Microsoft completely removed the vulnerable feature rather than attempting a traditional code patch.​ The security flaw exists within the main executable library […]

The post New Windows Error Reporting Vulnerability Lets Attackers Escalate to Gain SYSTEM Access appeared first on Cyber Security News.

The Internet Systems Consortium (ISC) has released a critical security advisory warning network administrators of a high-severity vulnerability affecting the Kea DHCP server. Tracked as CVE-2026-3608, this flaw allows unauthenticated remote attackers to trigger a stack overflow error. When successfully exploited, the vulnerability causes the receiving daemon to crash, resulting in a sudden and total […]

The post ISC Warns of High-Severity Kea DHCP Flaw That Can Crash Services Remotely appeared first on Cyber Security News.