TECHNO CHAT / TECH BLOG

Latest articles — page 7

CyberStrikeAI Agents Drive Windows Domain Takeovers

Hackers are using an AI-driven command framework called CyberStrikeAI to break into Windows networks and take over entire domains. Education organizations in Africa and Latin America were among the confirmed victims. The tool lets a language model decide which commands to run, so the operator no longer types each step by hand. CyberStrikeAI Framework in Live Intrusions CyberStrikeAI is an open-source, Go-based platform built for penetration testing. Criminals have already…

Saugata DattaNov 2, 20264 min read107

Data Breach

WS Audiology IT Disruption Affects Hearing Aid Services

WS Audiology, also known as WSA, is investigating a cybersecurity incident after unauthorized parties accessed parts of its IT infrastructure. The company disconnected selected internal and customer-facing systems to contain the threat, and that interrupted digital services used by hearing aid wearers and hearing care professionals. The hearing aids themselves were not affected. For customers, the immediate impact involved app controls, fitting tools, and remote support rather than a confirmed…

Saugata DattaNov 2, 20263 min read95

Cybersecurity

Ivanti’s latest Connect Secure fix blocks two chained flaws

Ivanti has released security updates for two more Connect Secure remote access gateway flaws that were chained in zero-day attacks starting at least on October 1. The two issues, CVE-2026-111357 and CVE-2026-118527, were used together with CVE-2026-104935, an authentication bypass flaw patched last month. Attack chain details CVE-2026-111357 is a high-severity privilege escalation issue. CVE-2026-118527 allows authenticated attackers to upload files on an unpatched device. Ivanti said in an advisory…

Saugata DattaNov 2, 20262 min read94

Artificial Intelligence

AI now sits inside a Windows infostealer, and VOLTA is using it to sort victims by money

Cisco Talos has uncovered a new malware family called VOLTA-AUTODOXER, also known as VOLTA, that uses a large language model to rank stolen data by monetization value. The malware behaves like a conventional stealer in many ways, but its real twist is the added AI layer that turns raw theft into a structured assessment. Instead of stopping at passwords and cookies, it tries to build a dossier that tells the…

Saugata DattaNov 2, 20264 min read97

Cybersecurity

Hackers Drain Bitcoin Hot Wallets on BTCPay Servers as Project Urges Immediate Shutdown

BTCPay Server has issued an urgent warning after reports that attackers were draining Bitcoin hot wallets on its servers. The open-source payment processor told operators to shut down affected installations immediately and keep them offline while the team investigates. For merchants using wallet management through these servers, the warning is about more than software hygiene. It is about funds that may already be exposed. Shutdown order and early signals In…

Saugata DattaNov 2, 20263 min read105

DevOps and Infrastructure

Command Injection Campaign Hits 61 GitHub Repos, Aiming at CI/CD Secrets

A coordinated command-injection campaign targeted 61 public GitHub repositories on September 1, 2026, using issues, pull requests, and comments to trigger code execution inside GitHub Actions workflows. Radware’s investigation identified 83 malicious items posted that day, with most activity concentrated in two rapid waves. The incident highlights how routine project discussions can become an entry point into automated build systems when workflows treat untrusted text as executable code. How the…

Saugata DattaNov 2, 20263 min read106

Linux

Linux 7.4-rc1 Lands After an Unusually Large, AI-Driven Merge Window

Linus Torvalds has released the first release candidate for Linux 7.4 following a notably large merge window. The snapshot, 7.4-rc1, arrives after two weeks of feature merges and contains roughly 20,000 commits — a step up from the kernel’s more typical ~15,000-commit merge. With substantial AMD register updates and a broad set of driver, architecture, filesystem and tooling changes, this release candidate sets the stage for an intensive stabilization period…

Saugata DattaNov 2, 20262 min read114

Cybersecurity

TightVNC Viewer Pre-Auth RCE: PoC Shows Remote Code Execution Risk

A newly disclosed vulnerability in the TightVNC Viewer allows attackers to execute code on Windows machines before a password prompt appears. Research credited to SeongJoon Cho of SSD Labs Korea includes proof-of-concept exploit code targeting TightVNC 2.8.88 x64. The flaw affects the viewer component and can be triggered when a viewer connects to a malicious server or when the viewer is reachable in Listening Mode. How the bug works The…

Saugata DattaNov 2, 20263 min read110

Cybersecurity

Critical CVE-2026-112816: LXD and MicroCloud Permit Trusted Client Impersonation (CVSS 10.0)

A newly disclosed critical vulnerability affecting Canonical's LXD and MicroCloud allows an attacker to authenticate as a trusted client without possessing that client's private key. Because the flaw undermines the server's certificate checks during mutual TLS authentication, an attacker with network access to the HTTPS API and a trusted client's public certificate can present a crafted certificate chain and be accepted as the trusted identity. Canonical has released patched snap…

Saugata DattaNov 1, 20263 min read99

Microsoft

NetamLoader: .NET Injection Attack Hits Government Windows 10 Build in Asia

Cybersecurity researchers have disclosed a sophisticated multi-stage intrusion that targeted a government-only Windows 10 build in Asia using a previously undocumented .NET assembly-loading framework dubbed NetamLoader. Kaspersky researchers who investigated the artifact say the sample was discovered in the first half of 2026 and was packaged inside a Windows cabinet (CAB) archive placed in a directory normally used for Windows update packages. The operation appears to have used AppDomainManager injection…

Saugata DattaNov 1, 20264 min read111

DevOps and Infrastructure

How TraderTraitor Pulled Off a $6.43B Heist and Where the Stolen Crypto Went

The U.S. Federal Bureau of Investigation (FBI) has publicly attributed the theft of $6.43 billion in virtual assets to TraderTraitor, a North Korea–linked hacking cluster. Working with the U.S. Secret Service and the IRS Criminal Investigation unit, investigators say the group converted a large share of the stolen funds into Ethereum and began moving assets through decentralized finance (DeFi) and instant-swap services as part of a multi-stage laundering effort. The…

Saugata DattaNov 1, 20263 min read110

Cybersecurity

Supply-chain Compromise Drains $2.7M from Polymarket After DebugBear Script Hijack

A malicious change to a third-party page-speed script on Polymarket’s site allowed attackers to use signed-in traders’ browser sessions to sell positions and siphon funds on October 29. The injected code targeted only Polymarket’s copy of a DebugBear real user monitoring (RUM) script and moved crypto to an attacker-controlled wallet in under an hour. Polymarket says it will refund roughly $2.7 million to affected wallets and is returning a total…

Saugata DattaNov 1, 20264 min read111

Latest articles — page 7

Free Tools: IP, DNS, SSL