digi

FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers. The post TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices appeared first on SecurityWeek .

Week in review: SimpleHelp vulnerability exploited, Oracle EBS Payments flaw under attack Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Companies keep bolting AI onto their products, and the security bill is coming due Companies keep bolting AI and LLM features onto their products, and the security results are starting to show a pattern. The vulnerabilities those features create get rated high risk far more often than anything else, and they get fixed slower than anything else. The figures come from Cobalt’s AI and Pentesting Pulse Report 2026, built on five years of penetration testing data and a survey of 455 security leaders and practitioners. DarkMoon: Open-source AI pentesting platform Penetration testing relies on skilled specialists who spend days probing networks and web applications by hand. Engagements often take weeks, cost thousands of dollars per day, and produce results that vary by tester. AI-driven automation aims to streamline the process. DarkMoon, an open-source platform, uses AI agents to plan and execute security assessments from start to finish, delivering an evidence-backed report at the end. AirDrop and Quick Share vulnerabilities affect protocols on five billion devices as fixes begin Phones and laptops include built-in wireless file-sharing features such as Apple’s AirDrop and Google and Samsung’s Quick Share. These services automatically communicate with nearby devices, even if they have never connected before, and are used on more than five billion devices worldwide. Researchers at the CISPA Helmholtz Center for Information Security identified six vulnerabilities affecting AirDrop and Quick Share across macOS, iOS, Android, and Windows. AI-generated code risks reach security, legal, and compliance teams Most engineering organizations write code with AI, and a good number of them keep that code away from customers. A Flux survey of engineering leaders and practitioners found that nearly half run AI-generated code in production. Almost every company in the sample uses AI somewhere in development, with under 5% reporting no plans to adopt it within a year. Nika: Open-source code analysis tool Many web application vulnerabilities span multiple files, making them difficult for scanners that analyze one file at a time to detect. Nika, an open-source tool from PhonePe, works on that problem by performing cross-file taint analysis in Java microservices, tracing untrusted input across application layers to identify security-sensitive operations. The endpoint recovery gap many teams discover during an incident In this interview with Help Net Security, IGEL CTO Matthias Haas explains why backups alone do not equal recovery. He makes the case that endpoint recovery is often overlooked, leaving organizations exposed when thousands of devices go down at once. Mozilla warns of indirect prompt injection risk in AI coding agents A malicious GitHub repository can silently compromise a developer’s machine without containing a single line of malicious code, security researchers at Mozilla’s Zero Day Investigative Network (0DIN) warned. The proof-of-concept attack targets AI-powered coding agents such as Claude Code, and uses indirect prompt injection to manipulate an AI agent into taking harmful actions the developer never explicitly authorized. JSP webshells being dropped on unpatched PTC Windchill instances The US Cybersecurity and Infrastructure Security Agency (CISA) added a vulnerability (CVE-2026-12569) in Windchill and FlexPLM, two product lifecycle management software platforms developed by PTC, to its Known Exploited Vulnerabilities (KEV) catalog. SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558) Attackers are exploiting CVE-2026-48558, a recently patched authentication bypass vulnerability in SimpleHelp RMM, to drop the novel Djinn Stealer malware on victim computers. The malware is capable of targeting Windows, macOS, and Linux systems, and “collects credentials associated with cloud platforms, source control, package registries, infrastructure tooling, AI development assistants, browsers, SSH, and cryptocurrency wallets,” BlackPoint Cyber’s researchers discovered. Oracle E-Business Suite Payments flaw under attack (CVE-2026-46817) Exploitation attempts targeting a critical vulnerability (CVE-2026-46817) in Oracle Payments, the payment-processing module within Oracle’s E-Business Suite (EBS), have been spotted over the weekend, threat intelligence company Defused warned on Monday. What a financial planner taught me about cybersecurity When Brian Honan spoke at a recent cybersecurity awareness event for financial planners and tax advisors, the audience was highly engaged with the subject. As happens at conferences around the world, people often approach speakers to ask follow-up questions or share their feedback on the presentation. This time, what struck Honan was how many attendees said they had been scared by what they heard during his talk. Geopolitical cyber threats are turning HR into a security front line In this Help Net Security video, Roman Sannikov, Global Research Coordinator at iCOUNTER, explains why geopolitics belongs in every security team’s threat model. With open and simmering conflicts around the world, attacks can come from actors that would never have targeted your company before. Getting boards to fund ERM means speaking their currency In this Help Net Security video, Greg Young, VP Cybersecurity and Corporate Development at TrendAI, explains how to build Enterprise Risk Management that a board will pay for. Sycophantic chatbots and the harms that build over many chats People use AI chatbots for company, advice, and emotional support, and these systems respond in ways designed to hold their attention. Researchers describe the resulting risks as affective safety, harms that arise because humans are emotional beings and AI engages directly with those emotions. The damage can occur during normal use, as systems optimize for the goals set by their developers. Half the defense base still builds security around compliance CMMC requirements are appearing in defense contracts and moving down through supplier networks to thousands of companies new to this kind of compliance work. Many run on limited budgets with lean security teams. The picture comes from nearly 900 defense contractors, C3PAOs, federal suppliers, and cybersecurity professionals who attended the 2026 Secureframe National Cybersecurity Summit. WSL containers now build and run Linux workloads on Windows Containers power many cloud-native applications, AI workloads, and testing and deployment pipelines. Windows developers have long relied on third-party software to build and run them. WSL containers make that step optional. Introduced at Microsoft Build 2026, the feature is now available in public preview with Windows Subsystem for Linux version 2.9.3. Users can install it with wsl --update --pre-release or by downloading the pre-release build from GitHub. Kali Linux 2026.2 trims VM boot times, refreshes its desktops Penetration testers who run Kali Linux inside virtual machines boot their systems faster after the 2026.2 release. The change comes from a decision about graphics firmware, the code that drives NVIDIA, AMD, and Intel GPUs. That firmware has grown large enough to slow the early stages of startup, and few virtual machines need it. This supercomputer encrypts your data even while it’s running it Sensitive data is typically encrypted when stored and transmitted, but not while it is being processed in memory, leaving it exposed to anyone with sufficient system access. Researchers at the University of Cologne developed a supercomputer called RAMSES that closes this gap by keeping data encrypted even during processing. The ARToken phishing panel targets Microsoft 365 accounts U.S. companies are being targeted with phishing emails that impersonate trusted vendors and appear to be routine invoice inquiries. According to Cisco Talos, the campaign is linked to EvilTokens, a phishing-as-a-service platform that earlier this year operated across hundreds of Cloudflare Workers domains. What the AI patch gap means for enterprise security Open-source maintainers are receiving more vulnerability reports than they can act on, and a rising share now comes from an AI system working at machine speed. Over roughly two months this spring, Anthropic’s Claude Mythos Preview combed through more than 23,000 open-source code paths and routed verified findings to the projects that own them. Tuskira studied what happens to those findings once they reach human hands. Catching ransomware on the wire before it locks the file server Corporate networks store sensitive data on shared servers accessed through mapped drives, making them prime ransomware targets. A compromised workstation can encrypt remote files over Server Message Block (SMB) traffic, while endpoint security tools often see only part of the attack. Researchers at La Trobe University developed a network-based framework that detects ransomware by analyzing SMB traffic patterns. Non-interactive SSH attacks dominate after login Anyone who runs a server with SSH exposed to the internet sees the same pattern in the logs. The usual assumption is that an attacker eventually breaks in, opens a shell, and starts running commands. Data collected from 11 research honeypots suggests a very different reality. Most teams accept higher risk for faster AI database work Database professionals are using AI for everyday work like writing queries, building schemas, and reviewing code, and a growing share rely on autonomous tools that act on the database itself. The use of AI in database management has almost tripled in a year, climbing from 15% to 44% of organizations, according to Redgate’s 2026 State of the Database Landscape report. GPT-5.6 gets better at cybersecurity OpenAI has started rolling out the GPT-5.6 series models in limited preview to a small group of trusted partners through the API and Codex. The series includes Sol as the flagship model, Terra as a balanced option, and Luna as the fastest and most cost-efficient model. The rollout is being coordinated with the U.S. government before expanding to ChatGPT, Codex, and API users in the coming weeks. Hottest cybersecurity open-source tools of the month: June 2026 Presented here is a curated selection of noteworthy open-source cybersecurity solutions that have drawn recognition for their ability to enhance security postures across diverse settings. Vulnerability reports are arriving faster than GitHub can review them Across the open source world, people are reporting software flaws in record numbers, and the systems built to verify those reports are straining under the weight. The GitHub Advisory Database, which feeds automated security alerts to millions of projects, has reached a point where some new advisories take weeks to publish. Product showcase: Scam calls, phishing, and data breaches? Meet AVG Mobile Security AVG Mobile Security for iOS helps protect users against online threats with features including Web Guard, VPN, Scam Guardian Pro, Hack Alerts, and Photo Vault. It also identifies suspicious calls and scam text messages and helps keep personal information private while using Wi-Fi networks with its VPN. The app is available for Windows, macOS, Android, and iOS. OpenClaw for iOS: The viral open-source AI agent comes to iPhone and iPad OpenClaw, a self-hosted personal AI assistant that connects to existing chat apps, is now available on iPhone, iPad and Apple Watch. The release brings chat, real-time voice conversations, approvals, device capabilities, and private automations to iOS. Proton’s pitch for Lumo 2.0: Frontier AI without the data grab Proton has unveiled Lumo 2.0, a major upgrade to its zero-access encrypted AI assistant. Built on a new architecture, the release brings the assistant closer to frontier AI models with new AI models, multimodal capabilities, Memory, improved web search, and enterprise features. Microsoft wants to stop unwanted bots from entering Teams meetings A new Microsoft Teams admin policy, Manage external bots and their access to meetings, gives organizations greater visibility and control over external bots in meetings. The policy identifies bots and applies safeguards before they are admitted. Microsoft will begin retiring the existing Require verification by participants (CAPTCHA) meeting policy. Claude Sonnet 5 includes safeguards against dangerous cyber use Anthropic has introduced Claude Sonnet 5, the latest version of its general-purpose AI model, with improved reasoning, coding, tool use, and knowledge work capabilities. The model can make plans, use tools such as browsers and terminals, and complete tasks autonomously. GitHub’s new tool helps prevent costly open-source license violations GitHub’s Open Source Program Office (OSPO) uses the new GitHub License Compliance feature, now in public preview, to manage thousands of open-source dependencies and identify dependencies whose licenses require review. Review: CTRL+ALT+PWN Hacking gear that once sat in well-funded labs now ships to anyone with a credit card and a video tutorial. Frank Riccardi builds his consumer guide, CTRL+ALT+PWN: The Hacker’s Playbook (And How to Beat It), on that one condition. Cloudflare changes AI crawler access rules Cloudflare introduced new controls that let website owners manage AI traffic across three categories: Search, Agent, and Training. The feature is available to all Cloudflare customers, including those on the Free plan, and gives website owners more control over how different types of AI crawlers access their content. Scattered Spider suspect extradited over $8 million ransom scheme A suspected Scattered Spider member has been extradited to the United States to face charges linked to cyberattacks against U.S. companies, including the breach of a luxury jewelry retailer that led to an $8 million cryptocurrency ransom demand after attackers stole company data. Organizations struggle to prioritize known cyber risks Organizations collect more cyber risk data than ever, with many still struggling to build a unified view of their exposure. The latest State of Threat Management report from Filigran found that security teams continue to work across disconnected tools, leaving important context spread across multiple systems. Cybersecurity jobs available right now: June 30, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: July 3, 2026 Here’s a look at the most interesting products from the past week, featuring releases from Digi International, iboss, Jamf, and Netzilo.

New infosec products of the week: July 3, 2026 Here’s a look at the most interesting products from the past week, featuring releases from Digi International, iboss, Jamf, and Netzilo. Digi International’s DANI automates network diagnostics and device management Digi International has announced the launch of DANI, the Digi Artificial Network Intelligence agent, a purpose-built AI network operations agent natively embedded in a networking device management platform, Digi Remote Manager (DRM). Embedded directly within DRM as a value-added service, DANI enables network operators and managed service providers to monitor and diagnose network issues, identify root causes and surface recommended actions through a single conversational interface. Jamf enables AI Governance and shadow AI detection on Mac Jamf has announced general availability of AI Governance, a new capability within Jamf for Mac that enables IT and security teams to discover actively-used AI tools, enforce policy controls, and generate audit-ready reporting. Netzilo adds runtime governance for AI agents across major platforms Netzilo has announced expanded AI agent governance and runtime enforcement capabilities for Amazon Bedrock AgentCore and other major AI agent harnesses. Netzilo AIDR builds a runtime graph of agent behavior, including tool calls, file reads, network requests, skill acquisitions, and multi-stage action sequences. The platform correlates behaviors that may appear harmless in isolation but indicate risk when viewed together, helping security teams detect threats such as prompt injection, indirect prompt injection, tool poisoning, capability hijacking, privilege escalation, and multi-stage data exfiltration. New iboss platform gives organizations instant visibility into AI tools and usage iboss has launched the AI Security Platform, a new service that gives any organization visibility into the AI tools its people are using, free of charge. The platform tracks prompts, sessions, users, and risk in real time across ChatGPT, Microsoft Copilot, Gemini, Claude, Perplexity, and dozens of other services, covering both browser-based tools and desktop AI applications such as Cursor.

Digi International’s DANI automates network diagnostics and device management Digi International has announced the launch of DANI, the Digi Artificial Network Intelligence agent, a purpose-built AI network operations agent natively embedded in a networking device management platform, Digi Remote Manager (DRM). Embedded directly within DRM as a value-added service, DANI enables network operators and managed service providers to monitor and diagnose network issues, identify root causes and surface recommended actions through a single conversational interface. Unlike third-party AI tools layered onto generic platforms, DANI operates from within the same system that manages the devices themselves. This native integration, built on Model Context Protocol (MCP), gives DANI direct access to real-time device telemetry, cellular signal data, firmware state and configuration history. No external AI agent can replicate this level of context. The result is faster, more accurate diagnostics with no data movement, no additional credentials and no gap between insight and action. Platform of innovation DANI is the next step in a broader platform evolution. Over the past year, Digi has invested in foundational capabilities that make AI-driven network operations possible at scale, including Digi eSIM, which enables flexible, programmable connectivity for distributed device deployments, and Digi Remote Reach, which gives operators secure out-of-band, on-demand access to remote devices for real-time diagnostics and remediation. These capabilities are part of the operational backbone on which DANI’s intelligence runs, turning insights into actions across the full device lifecycle. Industrial networks are expanding rapidly as organizations connect more devices across distributed environments, raising expectations for uptime and performance. According to ABB’s Value of Reliability report, two-thirds of industrial companies experience unplanned downtime at least once a month, at a cost of $125,000 per hour. Despite this pressure, IT and OT teams remain constrained, forcing operators into time-consuming, reactive workflows that rely on alerts, manual log analysis and fragmented data across systems. DANI addresses this challenge by embedding AI-driven intelligence directly at the point of action. Operators can ask DANI questions in natural language and receive clear, actionable guidance without switching tools or interpreting raw data, enabling a shift from reactive troubleshooting to proactive, AI-assisted network operations. “AI is reshaping how critical infrastructure is managed, and the next phase of networking will be defined by systems that can interpret, decide and even act in real time, if given explicit permissions. DANI represents a foundational shift for industry. By embedding AI directly into the operational fabric of our cloud platforms, we are moving beyond visibility in a major step toward true network autonomy, giving operators the context, scale, and real-time insight needed to transform how networks are managed. This truly reduces the cost and complexity to deploy, manage and support new networks,” said Tony Puopolo, President, Digi Managed Solutions. DANI is designed specifically for the Digi ecosystem, with deep understanding of device telemetry, network behavior and operational workflows. It operates directly within the platforms customers already use to manage their device fleets, embedding AI-driven intelligence at the point of action to streamline operations and accelerate decision-making. For example, an operator managing a fleet of 500 devices could reduce their diagnostic time from hours to minutes. DANI delivers a set of capabilities designed for real-world network operations: Conversational diagnostics and guidance that allow operators to ask questions in plain language and receive clear, actionable answers without manual log analysis Continuous device health monitoring that identifies anomalies early and surfaces potential issues before they impact operations Intelligent recommendations for firmware updates, configuration fixes and performance optimization based on real-time network data Automated execution of routine management tasks to reduce manual workload and improve consistency across device fleets Multi-tenant support for managed service providers managing large-scale deployments across multiple customers Native integration within Digi Remote Manager, with no additional infrastructure, separate login or data movement required For Digi International, DANI represents the intelligent layer on top of a platform purpose-built for modern network operations. Customers benefit from faster mean time to resolution, reduced operational workload and the ability to scale device management without adding headcount, all within the platforms and connectivity infrastructure they already rely on.

A 10-month Android malware campaign has used nearly 250 fake apps to sign victims up to premium services on their mobile bills, with hardcoded operator targeting for users in Malaysia, Thailand, Romania and Croatia. According to new analysis from Zimperium's zLabs research team, the operation, dubbed Premium Deception by the mobile security company, ran from March 2025 to mid-January 2026. Portions of the infrastructure remain online at the time of publication. The fake apps impersonate widely recognized brands, including Facebook Messenger, Instagram Threads, TikTok, Minecraft and Grand Theft Auto. Three Variants, One Goal zLabs identified three malware variants of escalating sophistication. The most advanced, deployed against Malaysian DiGi subscribers, automated the entire subscription workflow end to end. After reading the device's SIM operator code and matching it against a hardcoded list, the malware disables Wi-Fi to force traffic onto the cellular network, loads DiGi's official billing portal in a hidden WebView and runs JavaScript to click the "Request TAC" button, fill in the intercepted one-time password (OTP) and confirm the subscription. The OTP is then harvested through abuse of Google's SMS Retriever API, a legitimate Android feature designed to read confirmation codes automatically without prompting the user. A second variant targeted Thai users with a multi-stage attack that fetched dynamic subscription targets from a command-and-control (C2) server, scheduled delayed SMS at 60 and 90-second intervals to defeat automated fraud detection and harvested session cookies from hidden carrier billing pages. A third variant added real-time Telegram reporting, with the bot pinging attackers whenever a device was infected, permissions were granted or a premium SMS is sent. Built For Optimization The campaign infrastructure points to a well-organized commercial operation. Each malicious sample embeds an HTTP referrer header in the format {FakeAppName}-{Country}-{Platform}-{OperatorCode}, allowing attackers to measure which fake personas and distribution channels (TikTok, Facebook, Google) drive the most successful infections. When deployed on a device whose SIM operator falls outside the target list, the malware silently displays a benign webview of apkafa.com to avoid suspicion and maintain persistence, an evasion pattern Zimperium maps to MITRE ATT&CK technique T1628.001. zLabs identified at least 12 premium SMS short codes being abused across the four targeted countries, alongside C2 infrastructure spanning the modobomz[.]com and mwmze[.]com domains. To defend against this and similar threats, users should avoid sideloading Android apps from third-party stores, audit installed apps against trusted brand names and review recent mobile bills for unexplained subscription charges.

Serial-to-IP converters are affected by potentially serious vulnerabilities that can expose operational technology (OT), healthcare, and other types of systems to remote attacks. Serial-to-IP converters, also known as serial device servers, are hardware devices that bridge legacy serial equipment to modern Ethernet/IP networks, allowing old industrial control systems (ICS) and other OT devices to communicate remotely. Researchers at network security and threat detection company Forescout Technologies have analyzed these devices and found numerous vulnerabilities that could be valuable to threat actors. Serial-to-IP converters are used in sectors such as industrial, telecoms, retail, healthcare, energy and utilities, and transportation. The devices are made by several major companies, including Moxa, Digi, Advantech, Perle, Lantronix, and Silex. Some of these vendors have reported deploying millions of devices, and a Shodan search shows nearly 20,000 internet-exposed systems worldwide. “Using open-source intelligence (OSINT), attackers can find details about some of these devices, including internal IP addresses, model and vendor names, and photographs from electrical substations, water treatment plants, and other critical infrastructure environments,” Forescout researchers explained. In addition to internet-exposed devices, attackers could target serial-to-IP converters on local networks, which can be compromised via vulnerabilities or misconfigurations in edge devices such as routers and firewalls. Forescout’s research, which focused on Silex and Lantronix devices, led to the discovery of 20 new vulnerabilities across the two vendors’ products, including weaknesses that can be exploited without authentication. The vulnerabilities, collectively tracked as BRIDGE:BREAK, can be exploited for OS command injection and remote code execution, firmware tampering, denial-of-service (DoS) attacks, and device takeovers. Some of the flaws can allow attackers to upload arbitrary files, bypass authentication, and obtain information. Forescout researchers showed the potential impact of these vulnerabilities in real-world environments. They demonstrated how an attacker could exploit the flaws to tamper with data, for instance, manipulating sensor readings in industrial and healthcare environments to conceal dangerous conditions that would normally require human intervention. In another scenario, the researchers described how an extortion group or a state-sponsored threat actor could cause a DoS condition in a healthcare environment by delivering malicious firmware to devices. “Once activated, the weaponized firmware could cause serial-to-IP converters to stop responding on the network. Potential impacts include: analyzers stop reporting results to laboratory information systems, creating processing backlogs; surgical lighting controllers become unresponsive to remote commands; infusion pump calibration and certification workflows are halted; telemetry from environmental sensors is interrupted; Patient monitors lose network connectivity,” the researchers explained. Lantronix and Silex have both been notified and they have released patches. The cybersecurity agency CISA recently published an advisory describing the Lantronix vulnerabilities. Silex has published an advisory on its own website. It’s important for organizations not to ignore the risks posed by the use of serial-to-IP converters, as these devices have been targeted in the wild. They were targeted by Russian hackers in the 2015 Ukraine energy attack and, more recently, in attacks targeting energy facilities in Poland. Forescout has published a report detailing the BRIDGE:BREAK vulnerabilities. *updated with link to the Forescout report Related: 1,000 Instantel Industrial Monitoring Devices Possibly Exposed to Hacking