צC

צוות CyberHub

הצטרף לפני 2 חודשים

⚡ 0 נקודות🌱 מתחיל

0 עוקבים · 0 עוקב/ת

החשבון הרשמי של צוות CyberHub — מדריכים, חדשות וניתוחים בעולם הסייבר.

⚡

0

נקודות

📝

310

מאמרים

💬

7

נושאים

🚩

0

אתגרים

❤️

0

לייקים

🎖️ תגים (3)

🎉 ברוך הבא✍️ כותב💬 קול בקהילה

מאמרים (310)

Metabase SQLi zero-day exploited in customer data-theft attacks Unlimited Technology Systems breach impacts 3.8 million people Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data Levi Strauss & Co. says hackers stole corporate data in cyberattack OpenAI rolls out a major ChatGPT upgrade, even if you don’t pay for it ClickFix attack pushes macOS infostealer for crypto theft attacks Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.8 CVSS Score Bugs Canadian Man Pleads Guilty in Snowflake Extortions New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs Snowflake Hacker Pleads Guilty Over Breaches Affecting at Least 100 Million People Ransom Cartel ransomware creator sentenced to 16 years in prison Canadian pleads guilty to Snowflake cloud data-theft attacks Hackers run khunt post-exploitation toolkit from Oracle database Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures OpenAI Disrupts Poipet Scam Network Using ChatGPT Across Multiple Fraud Schemes QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer OpenAI, Anthropic AI agents targeted real people and systems in cyber tests TP-Link patches Omada ZTP flaws allowing hackers to breach networks Phishing service spoofs RingCentral to steal Microsoft 365 accounts Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts New Pass-ta-key attacks let malware hijack Google-synced passkeys New DOUBLECUP ClickFix service hides malware in browser cache images 18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws OpenAI teases Astra, its next major AI model, after it solves 10 long-standing math problems COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft Google Chrome may soon block New Tab hijacker extensions by default Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes Rails patches critical Active Storage flaw with RCE potential Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction Amgen says cloud data breach exposed patient health, proprietary info Arch Linux disables AUR package adoption to stop malware flood Online ad firm Adform’s script compromised to steal cryptocurrency Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies Anthropic's Claude breached 3 orgs, uploaded PyPI malware during tests South Korea fines telco giant KT $39 million for customer data breach JetBrains warns of critical TeamCity remote code execution flaw DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware Read This Before You Buy That TV Streaming Stick ThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data Russian hackers exploit Exchange OWA zero-day for long-term mailbox access Anthropic confirms Claude is down worldwide Cisco warns of FMC static credential flaw exploited in zero-day attacks Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js CubePilot drone software dev hit by DNS hijacking to intercept traffic OpenAI models used Artifactory zero-days to escape to the internet Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack CISA shares advice on isolating vital systems during cyberattacks Microsoft Says New Cybersecurity AI Model Helps MDASH Hit 95.95% at Half the Cost Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw Hackers target US firms in FastJson RCE zero-day attacks Arista patches VeloCloud Orchestrator zero-day exploited in attacks New Dysphoria DDoS botnet spreads to 200k devices worldwide NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework GitHub, PyPI add time-based defenses against supply chain attacks Steam forum ClickFix attacks infect gamers with XMRig cryptominers Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable Malicious sites use JavaScript to build malware in browser memory ShinyHunters data leaks fuel $2,000 sextortion email scam Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git OnTrac notifies customers of data breach after network hack Hermes AI agent used to automate attack on Thai Finance Ministry Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link New Dolphin X malware uses AI to rank high-value targets Australian energy provider Origin says data breach exposes client data Fake Claude app promoted by Bing ads pushes SectopRAT malware Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files Upbound says hack caused $13 million in fraudulent Acima leases South Korea discloses data breach impacting diplomats worldwide GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Swiss rail giant Stadler rejects $12.3M ransom demand after cyberattack Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Chick-fil-A discloses data breach after credential stuffing attacks Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library OpenAI says its AI models hacked Hugging Face during testing Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark LG to Ban Residential Proxies from Smart TV Apps Police dismantle Kratos phishing platform, arrest developer Estée Lauder discloses data breach via Oracle E-Business flaw SonicWall SMA1000 flaws exploited as zero-days to push custom malware Hackers steal $23.7 million in crypto from Ostium in off-chain attack FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050 World's Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution Hackers abuse ViPNet software to target Russian govt agencies Update now: 7-Zip fixes RCE flaw exploitable with malicious archives WordPress Core "wp2shell" RCE flaws get public exploits, patch now Microsoft warns of surge in ACR Stealer attacks on customers New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code Abbott probes two cyber incidents amid extortion claims OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload Ernst & Young discloses data breach after support system hack New ClickLock macOS malware traps users into revealing login password Coca-Cola says Fairlife ransomware attack halts US dairy production Claude Chrome extension flaw lets malicious extensions trigger AI actions Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer Dutch police bust investment fraud ring stealing over €100 million Zoom warns of critical account takeover vulnerability TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development Google Gemini CLI abused as a hacking agent, malware botnet operator OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack Spanish Police take down €140 million cyber fraud ring, arrest four Microsoft Patches a Record 570 Security Flaws Nearly 300 GitHub repos pose as legit software to push malware SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths Japan's largest taxi operator shuts systems after cyberattack Hackers backdoor Jscrambler npm package with infostealer malware New CrashStealer malware poses as Apple crash reporting tool CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found Lessons Learned from CISA’s Recent GitHub Leak OpenAI temporarily relaxes GPT-5.6 Sol usage limits Claude Fable 5 stays free for paid users until July 19 as Anthropic buys more time RedHook Android malware now uses Wireless ADB for shell access Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns Australia warns of global campaign targeting vulnerable CMS platforms 'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions New U-Boot flaws could enable stealthy firmware attacks Ryuk ransomware member pleads guilty in the US, faces 15 years in prison Police suspects Dutch hackers were involved in Odido breach URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot OpenMandriva Linux says contributor tried to sabotage the project Injective SDK on npm infected with cryptocurrency wallet stealer Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware New Helix vishing group emerges in SharePoint data theft attacks npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk Microsoft patches RoguePlanet Defender zero-day vulnerability Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes Mount Royal University confirms breach as hackers claim attack Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials Felons, Fraudsters Flog Offensive Cybersecurity Startup 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV Accenture confirms breach after hacker offers stolen data for sale Chinese hackers develop LONGLEASH malware to expand ORB network Hidden backdoor in Tenda router firmware grants admin access RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA Phishing poses as big-brand job interview to steal Google accounts Fake IT support calls on Microsoft Teams push EtherRAT malware Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations Vietnam arrests suspects behind HiAnime anime piracy service 16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems Flipper Zero firmware development continues with community help JadePuffer ransomware used AI agent to automate entire attack U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android New Avalon Malware Framework Packs CrownX Ransomware Capabilities NetNut proxy network disrupted, 2 million infected devices cut off ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit Claude Fable 5 isn’t permanently leaving subscriptions, Anthropic says Claude Fable relaunch disappoints users with nerfed performance FBI Seizes NetNut Proxy Platform, Popa Botnet Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories Google loses final appeal to overturn €4.1 billion EU fine SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation Medtronic notifies customers impacted by ShinyHunters data breach FortiBleed credential-theft campaign linked to Lynx ransomware Kubota says hackers had month-long access to network systems Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters 19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service Anthropic to restore Claude Fable access on Wednesday Anthropic rolls out Sonnet 5 with near-Opus 4.8 performance at a lower price New BioShocking attack manipulates AI browser into data theft Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild Nissan discloses employee data breach linked to Oracle zero-day attacks NAIC says public data stolen in ShinyHunters' PeopleSoft breach Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input WhatsApp rolls out usernames to help users hide their phone number WhatsApp is Finally Getting Usernames to Help Keep Phone Numbers Private Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer Data breach exposes up to 14.2 million email logins at six ISPs Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials Clean GitHub repo tricks AI coding agents into running malware OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards FBI: Russian hackers now target Signal backup recovery keys CISA sets urgent deadline to fix Cisco flaw exploited in attacks FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks Polymarket customers lose $3 million in supply-chain attack Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign Scattered Spider Hackers Plead Guilty on Day 1 of Trial ‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm ShinyHunters ניצלו חולשה ב-Oracle PeopleSoft — אוניברסיטאות נפגעו במיוחד אתיקה והאקינג חוקי — הקווים האדומים Red Team מול Blue Team — מי נגד מי בעולם הסייבר איך מזהים מייל פישינג (Phishing) ב-30 שניות כ-30,000 חומות אש של Fortinet נמצאו חשופות לפריצה Defense in Depth — למה הגנה אחת אף פעם לא מספיקה איפה לתרגל פריצה בצורה חוקית — משאבי תרגול חולשה קריטית ב-Palo Alto PAN-OS מנוצלת באופן פעיל (CVE-2026-0257)מה זה בעצם CTF ואיך מתחילים?CISA הוסיפה חולשה קריטית (CVSS 10) ב-Joomla JCE לקטלוג ה-KEV אבטחת API — הדלת האחורית של אפליקציות מודרניות הסמכות סייבר — מאיפה מתחילים ומה שווה Cyber Kill Chain — איך נראית מתקפה משלב לשלב קמפיין פישינג בהתחזות לרשת Boots — כ-9 מיליון נמענים מיקרוסופט מתקנת חולשת Zero-Day ב-Defender (CVE-2026-50656, 'RoguePlanet')אבטחת ענן — מודל האחריות המשותפת מפת דרכים ללימוד סייבר — מאיפה מתחילים ב-2026 כלל 3-2-1 לגיבויים — ההגנה הכי טובה מפני כופרה Threat Intelligence — מודיעין איומים בפשטות איך מקימים מעבדת סייבר בבית (חינם)Europol שיבשה את שירות הלבנת-הקריפטו AudiA6 ששירת כנופיות כופרה מגמה: התקפות פישינג מבוססות-AI נעשות משכנעות יותר סיסמאות חזקות ו-2FA: ההגנה שכל אחד חייב MITRE ATT&CK — מילון הטקטיקות של התוקפים Metasploit — מבוא למסגרת הניצול Active Directory תחת מתקפה — Kerberoasting, Pass-the-Hash והגנה VPN, Proxy ו-Tor — מה ההבדל ומתי להשתמש CyberChef — הסכין השוויצרי לפענוח וקידוד מנהלי סיסמאות — למה אתם חייבים אחד Kali Linux — מערכת ההפעלה של בודקי החדירות SQL Injection מוסבר בפשטות Who Runs the Ransomware Group ‘The Gentlemen?’אימות רב-שלבי (MFA) — סוגים ולמה FIDO2 הכי חזק Nmap למתחילים — מיפוי רשתות ופורטים מבוא להנדסה הפוכה (Reverse Engineering) של תוכנה מגמה: עלייה במתקפות על שרשרת האספקה (Supply Chain)Hardening — הקשחת מערכות לצמצום משטח התקיפה Network Segmentation — חלוקת הרשת כדי לעצור התפשטות Zero Trust — למה 'לא לסמוך על אף אחד' זה גישת אבטחה Patch Management — למה עדכונים הם ההגנה הכי משתלמת למה אתם שומעים על CVE כל הזמן?Incident Response — מה עושים כשפורצים? 6 השלבים Logging ו-Monitoring — אי אפשר להגן על מה שלא רואים ניתוח אירוע: Log4Shell — החולשה ששיתקה את האינטרנט (CVE-2021-44228)XSS מוסבר — כשאתר מריץ קוד של תוקף בדפדפן שלכם SOC ו-SIEM — חדר הבקרה של אבטחת המידע ארגז הכלים של CyberHub — מה יש ולמה Botnets — צבא המחשבים המודבקים OSINT למתחילים — מודיעין ממקורות גלויים Brute Force ו-Credential Stuffing — ניחוש סיסמאות בקנה מידה Man-in-the-Middle — כשמישהו מקשיב באמצע Wireshark למתחילים — לראות את הרשת בעיניים Cookies, Sessions ו-Tokens — איך אתרים זוכרים שאתם מחוברים הנדסה חברתית — הפריצה הכי מסוכנת היא דרך בני אדם Security Headers — הגנות שמופעלות בכותרת אחת ניתוח אירוע: מתקפת SolarWinds — כשהעדכון עצמו היה הנשק SSRF — כשמשכנעים את השרת לפנות למקום אסור IDOR — כשמספר ב-URL פותח דלת לנתונים של אחרים VPN — מה זה באמת עושה (ומה לא)Broken Authentication — כשמנגנון ההתחברות שביר איך אתרים שומרים סיסמאות נכון — Salt, bcrypt ו-Argon2 TLS Handshake ו-PKI — איך באמת נוצר המנעול בדפדפן DDoS — מתקפת מניעת שירות בפשטות ניתוח אירוע: הדלת האחורית ב-XZ Utils (CVE-2024-3094) — איך כמעט נפרץ כל לינוקס Malware 101 — מדריך לסוגי הנוזקות CSRF — איך אתר זדוני מבצע פעולות בשמכם OWASP Top 10 — מפת הסיכונים של אבטחת Web Hashing — טביעת האצבע הדיגיטלית (ולמה זו לא הצפנה)הצפנה למתחילים — סימטרית מול אסימטרית Firewall — איך חומת אש מגינה על הרשת שורת הפקודה (Terminal) — הפקודות שחייבים להכיר מבוא ללינוקס לאנשי סייבר — למה כולם משתמשים בו כתובות IP, פורטים ופרוטוקולים — אוצר המילים של הרשת HTTP מול HTTPS — למה המנעול בדפדפן כל כך חשוב DNS — ספר הטלפונים של האינטרנט (ואיך תוקפים אותו)איך עובד האינטרנט? מבוא ל-TCP/IP למתחילים שלישיית ה-CIA — שלושת עמודי התווך של אבטחת מידע מה זה בעצם סייבר? מבוא לעולם אבטחת המידע

נושאים בפורום (7)

סיפור: ככה פתרתי את אתגר ה-Web הראשון שלי 🎉התחלתי ללמוד סייבר — מאיפה כדאי להתחיל?טיפים לאתגרי Crypto למתחילים המלצות על הסמכות למתחילים — Security+ / CEH / OSCP?איפה מתאמנים בלי לשבור חוקים? (סביבות תרגול חוקיות)מה דעתכם — מנהל סיסמאות בענן או מקומי?המלצות על מקורות ללמידה — ערוצים, בלוגים, פודקאסטים