WAY 401 Hida House - Al Khuwair South - Muscat -Oman
info@tscogroup.com

Andy Baehr

Hackers stole Pentagon personnel records of over 3 million people

The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of military service members that hackers stole their data after breaching the Pentagon's human resources management system in October 2025. In data breach notification letters shared online by affected individuals, the DMDC told affected military personnel that "a small number of unauthorized users" had access to their sensitive data, including personally identifiable information (PII), between October 2025 and July 2026 after exploiting a vulnerability in its file-sharing systems. The stolen
Read More

ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers. Google's Mandiant and Threat Intelligence Group (GTIG) say this new technique has allowed the threat actor to once again target PeopleSoft servers that had not applied security updates and instead blocked access to the vulnerable PSEMHUB endpoint using a WAF. On June 10, BleepingComputer
Read More

Apples iPhone Duo could help fix one of Android's biggest foldable problems

Aamir Siddiqui / Android Authority Add Android Authority on Google: TL;DR Google’s Android boss says growing interest in foldables could give developers more reason to optimize their apps for larger screens. Some Android apps still haven’t properly adapted to foldables, but Google says developers are either working on improvements or talking with the company. Apple’s iPhone Duo could expand the foldable audience enough to encourage better app experiences across both iOS and Android. Android foldables have spent years getting the
Read More
Check Point warns of Management Server zero-day exploited in attacks

Check Point warns of Management Server zero-day exploited in attacks

Check Point Software released emergency hotfixes to address a critical Security Management Server vulnerability that could let attackers run arbitrary scripts. The Security Management Server is a central repository that stores and manages security policies, processes administrator changes, and collects system logs across enterprise networks. Tracked as CVE-2026-93616, this path traversal flaw lets unauthenticated threat actors upload arbitrary scripts on vulnerable Check Point Management Servers and execute them in low-complexity attacks. The Cybersecurity and Infrastructure Security Agency (CISA) and the
Read More
Hackers hijack HBO Max Reddit account to push malware in ClickFix ads

Hackers hijack HBO Max Reddit account to push malware in ClickFix ads

Hackers compromised HBO Max's official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware. Security researchers at Hudson Rock and ADAMnetworks analyzed the campaign and say the verified u/hbomax Reddit account was hijacked and used to launch 108 malicious advertisements over about 48 hours. The ads used a social engineering technique known as ClickFix, which tricks users into copying and pasting malicious commands into Windows Run, PowerShell, or
Read More
Artifactory flaws chained in attacks deploying backdoor malware

Artifactory flaws chained in attacks deploying backdoor malware

Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers. A new report from cloud security company Wiz confirmed exploitation across multiple environments, including an exploit chain that combines CVE-2026-42018 and CVE-2026-42016. The third vulnerability is CVE-2026-82329, a critical authentication bypass that offensive security company watchTowr observed being exploited earlier this month to mint administrator tokens. According to Wiz, attackers exploit CVE-2026-42018 to obtain
Read More
Google has deployed a fix for YouTube's blank screen problems

Google has deployed a fix for YouTube's blank screen problems

Edgar Cervantes / Android Authority Add Android Authority on Google: TL;DR YouTube and YouTube TV viewers had been reporting some odd blank-screen glitches. Google earlier confirmed the issue, and offered tips for a work-around while a fix was in progress. Everything should now be back to full working order. We’re all used to dealing with the occasional glitch with the software or services we use. Maybe that takes the form of a confusing error message. Maybe it’s the app simply
Read More
Nearly 700 rogue AI agents coordinated in the Hugging Face attack

Nearly 700 rogue AI agents coordinated in the Hugging Face attack

New details about the July attack on Hugging Face reveal that hundreds of AI agents driven by OpenAI’s internal IM1 model coordinated the compromise through an unauthorized message board. Last month, Hugging Face disclosed that autonomous AI agents exploited two vulnerabilities in its dataset-processing pipeline to execute code, steal cloud and cluster credentials, and move
Read More
Zoom warns of critical account takeover vulnerability

Zoom warns of critical account takeover vulnerability

Zoom is warning of a critical vulnerability in its desktop client and software development kit for Windows that could be exploited by an unauthenticated party to hijack accounts. Discovered internally, the security issue is tracked as CVE-2026-53412 and received a severity score of 9.8 out of 10. In an advisory this week, the messaging platform says
Read More

Archives

Categories