hacking Community | Digg

Researchers say Russian government hackers were behind attempted Poland power outage | TechCrunch

Security researchers attribute the attempted use of destructive 'wiper' malware across Poland's energy infrastructure in late December to a Russian-backed hacking group known for causing power outages in Ukraine.

@comdak

Hacker taps Raspberry Pi to turn Wi-Fi signals into wall art

French artist Théo Champion, also known as Rootkid, has created a piece called 'Spectrum Slit' that transforms nearby radio signals into light using a Raspberry Pi. The sculpture, which consists of 64 LED filaments, displays the intensity of radio signals in the 2.4 GHz and 5 GHz bands, used by Wi-Fi, Bluetooth, and other technologies. The project, which took around four weeks and cost approximately $1,000 to build, aims to make people more aware of the technology that surrounds them.

@comdak

FortiGate firewalls hit by silent SSO attacks & config theft... still happening after latest patch

FortiGate firewalls are experiencing silent attacks where attackers bypass SSO protections to reconfigure settings, create backdoor admin users, and steal configuration files. Arctic Wolf warns of automated malicious activity targeting FortiGate appliances since January 15. Despite patches for critical authentication bypass bugs, admins report ongoing intrusions, suggesting a patch bypass for CVE-2025-59718. Fortinet is preparing new releases to fully address the issue.

@comdak

New Android malware uses AI to click on hidden browser ads

A new family of Android click-fraud trojans uses TensorFlow machine learning models to detect and interact with hidden browser ads. The malware operates in 'phantom' mode using a hidden WebView browser and in 'signalling' mode using WebRTC to stream a live video feed to attackers. Distributed through Xiaomi’s GetApps store and third-party APK sites, the trojans are often hidden in seemingly legitimate apps, leading to covert click fraud with no visible indication to users.

@comdak

London boroughs limping back online months after cyberattack • The Register

Hammersmith & Fulham Council has resumed processing online and telephone payments two months after a cyberattack impacted multiple boroughs in London. While most services are now available, some council tax and housing rent account balances may not be current. The council has introduced enhanced security measures and is investigating the impacts on all systems and services. The attack also affected Westminster City and Kensington and Chelsea councils, with ongoing disruptions and investigations.

@comdak

72.7M Under Armour accounts hit in alleged ransomware leak

Have I Been Pwned reports that 72.7 million Under Armour customer accounts were affected by an alleged ransomware attack in November. The Everest ransomware group claimed responsibility and threatened to release stolen data unless Under Armour paid a ransom. The leaked data includes names, email addresses, dates of birth, genders, geographic locations, and details of previous purchases. Under Armour has not yet acknowledged the alleged leak.

@comdak

Ancient telnet bug happily hands out root to attackers

A recently disclosed critical vulnerability in the GNU InetUtils telnet daemon (telnetd) allows attackers to gain root access to a target system by exploiting an argument injection flaw. The bug, introduced in a May 2015 update, has been trivial to exploit and is already being targeted by attackers. Users are advised to update to the latest version of telnetd, restrict network access to the telnet port, or switch to a more secure alternative such as SSH.

@comdak

Hackers get $1,047,000 for 76 zero-days at Pwn2Own Automotive 2026

Pwn2Own Automotive 2026 concluded with security researchers earning $1,047,000 for exploiting 76 zero-day vulnerabilities in fully patched automotive systems. The competition, held in Tokyo, targeted in-vehicle infotainment systems, EV chargers, and car operating systems. Vendors have 90 days to release security fixes for the disclosed zero-days. Team Fuzzware.io won the contest with $215,000, followed by Team DDOS and Synactiv.

@comdak

149 Million Usernames and Passwords Exposed by Unsecured Database

A researcher discovered an unsecured database containing 149 million usernames and passwords, including millions for Gmail, Facebook, and Binance. The database, suspected to be collected using infostealing malware, was accessible to anyone via a web browser. The hosting provider removed the database after being notified by the researcher.

@comdak

Hacker who stole 120,000 bitcoins wants a second chance—and a security job

Ilya Lichtenstein, who was involved in a 2016 crypto heist stealing 120,000 bitcoins, has expressed remorse and a desire to turn his life around. Released from prison, he aims to use his skills for cybersecurity.

@comdak

Okta SSO accounts targeted in vishing-based data theft attacks

Okta has issued a warning about phishing kits specifically designed for voice-based social engineering attacks, known as vishing. These kits are being used in active attacks to steal Okta SSO credentials for data theft. Threat actors are targeting identity providers and cryptocurrency platforms by creating customized phishing pages and impersonating IT staff to trick employees into providing their credentials.

@comdak

Fake Lastpass emails pose as password vault backup alerts

LastPass has issued a warning about a phishing campaign that mimics a maintenance notification, urging users to back up their password vaults within 24 hours. The malicious emails contain a link to a phishing site, aiming to steal users' credentials. LastPass emphasizes that they never ask for master passwords and advises users to report suspicious emails to 'abuse@lastpass.com'.

@comdak

Why AI Keeps Falling for Prompt Injection Attacks

This article discusses the vulnerability of large language models (LLMs) to prompt injection attacks, a structural weakness that allows attackers to exploit LLMs into performing unauthorized actions. The article uses a drive-through analogy to explain how prompt injection attacks work and why they are difficult to prevent. It highlights the limitations of LLMs in assessing context and the challenges in creating AI systems that are both fast, smart, and secure.

@comdak

Zendesk ticket systems hijacked in massive global spam wave

This news article reports on a massive global spam wave originating from unsecured Zendesk support systems, affecting numerous companies including Discord, Tinder, and Dropbox. Attackers are exploiting Zendesk's feature that allows unverified users to submit support tickets, which then generate confirmation emails. These emails, bypassing spam filters due to their legitimate source, have bizarre subjects and are designed to confuse and alarm recipients, though they do not contain malicious links. Zendesk has introduced new safety features to address this issue and advises companies to restrict ticket creation to verified users and remove placeholders that allow any email addresses or ticket subjects to be used.

@comdak

Hackers breach Fortinet FortiGate devices, steal firewall configs

Fortinet FortiGate devices are under attack from hackers who are creating rogue accounts and stealing firewall configuration data. The attacks began on January 15, exploiting an unknown vulnerability in the devices' single sign-on (SSO) feature. Arctic Wolf, a cybersecurity company, reported that the attacks are similar to incidents documented in December 2025. It is not yet known if the latest attacks are covered by the patch for CVE-2025-59718 and CVE-2025-59719. Fortinet is planning to release new FortiOS versions to address the security flaw.

@wordfence

Former Employee Leaves Backdoor In WordPress Plugin With Over 20,000 Active Installs

On January 12th, 2026, the Wordfence threat intelligence team received a submission for a Backdoor vulnerability in the LA-Studio Element Kit for Elementor, a WordPress plugin with more than 20,000+ active installations. This vulnerability makes it possible for an unauthenticated

@comdak

Tesla hacked, 37 zero-days demoed at Pwn2Own Automotive 2026

Security researchers hacked the Tesla Infotainment System and earned $516,500 at Pwn2Own Automotive 2026 by exploiting 37 zero-days. The Synacktiv Team earned $35,000 for a USB-based attack on Tesla and an additional $20,000 for hacking the Sony XAV-9500ES. Team Fuzzware.io earned $118,000 for hacking various devices, while PetoWorks earned $50,000 for hacking a Phoenix Contact charger. The competition focuses on automotive technologies and takes place in Tokyo, Japan.

@comdak

ACF plugin bug gives hackers admin on 50,000 WordPress sites

A critical-severity vulnerability in the Advanced Custom Fields: Extended (ACF Extended) plugin for WordPress allows unauthenticated attackers to obtain administrative permissions, affecting approximately 50,000 sites. The flaw, tracked as CVE-2025-14533, arises from the lack of enforcement of role restrictions during form-based user creation or updates, even when role limitations are configured in the field settings. Discovered by security researcher Andrea Bocchetti, the issue was reported to Wordfence and subsequently addressed by the vendor in version 0.9.2.2. Although no attacks targeting CVE-2025-14533 have been observed, large-scale reconnaissance activity targeting potentially vulnerable sites has been reported.

Researchers say Russian government hackers were behind attempted Poland power outage | TechCrunch

Hacker taps Raspberry Pi to turn Wi-Fi signals into wall art

FortiGate firewalls hit by silent SSO attacks & config theft... still happening after latest patch

New Android malware uses AI to click on hidden browser ads

London boroughs limping back online months after cyberattack • The Register

72.7M Under Armour accounts hit in alleged ransomware leak

Ancient telnet bug happily hands out root to attackers

Hackers get $1,047,000 for 76 zero-days at Pwn2Own Automotive 2026

149 Million Usernames and Passwords Exposed by Unsecured Database

Hacker who stole 120,000 bitcoins wants a second chance—and a security job

Okta SSO accounts targeted in vishing-based data theft attacks

Fake Lastpass emails pose as password vault backup alerts

Why AI Keeps Falling for Prompt Injection Attacks

Zendesk ticket systems hijacked in massive global spam wave

Hackers breach Fortinet FortiGate devices, steal firewall configs

Former Employee Leaves Backdoor In WordPress Plugin With Over 20,000 Active Installs

Tesla hacked, 37 zero-days demoed at Pwn2Own Automotive 2026

ACF plugin bug gives hackers admin on 50,000 WordPress sites

/hacking

About

Community Guidelines

Founded by

Top Contributors