Archive for October 22, 2026

New Research Exposes DarkCore RAT That Hijacks Accounts Without Passwords

Posted in Commentary with tags on October 22, 2026 by itnerd

Today, BlackFog released new research on DarkCore, a remote-access trojan (RAT) with a dedicated browser designed to hijack logged-in accounts, including Gmail and WhatsApp, while making the activity appear to come from the victim’s own IP address.

Attackers don’t need your password if they can access a session you’re already logged into. DarkCore’s advertised browser lets operators reuse stolen session cookies, potentially bypassing new login and MFA prompts. By routing traffic through the victim’s IP address, the activity can appear legitimate even when an attacker is in control.

BlackFog’s research team investigated DarkCore’s underground marketplace listing and analyzed a Windows malware sample, uncovering how a deceptive PDF-themed shortcut could deliver the threat.

What they found:

Stolen sessions can provide direct access to accounts without requiring a new login, potentially bypassing MFA. DarkCore’s advertised browser also allows attackers to disguise their activity by routing traffic through the victim’s IP address, making unauthorized access harder to detect.

The researchers also uncovered a fake PDF shortcut that opens a legitimate World Bank report while secretly downloading malware in the background. Once a device is compromised, DarkCore’s advertised hidden desktop functionality could allow attackers to control a browser without the victim seeing the activity.

The findings highlight a growing security challenge: a familiar device or IP address doesn’t necessarily mean the person accessing an account is legitimate.

Read the full research here.

Leave a comment »

What the PHP flaws mean for regular internet users

Posted in Commentary with tags on October 22, 2026 by itnerd

Two critical vulnerabilities have been discovered in PHP, the programming language powering around 70% of websites, potentially putting businesses and internet users at risk.

Voldemaras Kadys, Head of Security & Platform Engineering at Mediatech, explains what these flaws mean for websites, how ordinary internet users could be affected, and why the release of security updates doesn’t necessarily mean websites are safe. Please find Voldemaras’s comments below:

What is PHP?

“PHP is a programming language that powers around 70% of all websites, including online services, stores, booking platforms, and many others. In other words, most websites you browse online are based on PHP and are therefore affected by the recent vulnerabilities.”

What were the flaws in it and why was an update needed?

“Two critical security flaws were discovered in PHP that could allow hackers to take control of vulnerable website servers and potentially steal customer information, change website content, install malware or take the website completely offline. The potential impact of these vulnerabilities may be huge, as most websites run on PHP.

PHP developers have already issued updates for these vulnerabilities, but that doesn’t mean all websites are automatically safe – website operators and hosting providers need to install the updates themselves, and hopefully they do that as soon as possible. The seriousness of the vulnerabilities is also evident from the fact that PHP released updates even for End-Of-Life (EOL) PHP versions, which are no longer actively supported and typically do not receive any more updates.”

Do regular web users need to worry?

“For regular internet users, simply visiting a PHP website doesn’t necessarily mean their device will be compromised. The risk is that attackers may exploit a website that holds their personal information. For example, if a user has an account with an online shop, attackers may be able to hack that website through this PHP vulnerability and extract the information the user has stored there, such as their email address, physical address, name and date of birth.

This kind of information may then be used for phishing, impersonation or other scams. However, not every PHP-powered website is vulnerable, and the vulnerability alone does not instantly mean a breach has happened.

There’s no reason to stop browsing or shopping online, but users should still be extra cautious about suspicious messages because we don’t know what kind of data hackers may have stolen through this vulnerability, and from which websites.”

Leave a comment »

Cyware Launches New “Last Mile” Agents to Help Smaller Organizations Act on the Threat Intelligence They Already Receive

Posted in Commentary with tags on October 22, 2026 by itnerd

Cyware today launched Cyware Last Mile Agents, a new class of AI agents built for the smaller member organizations that make up the last mile of most threat-sharing networks. Smaller companies and critical infrastructure organizations already receive threat intelligence from their community or state hubs, but most lack the staff and tools to act on it. Last Mile Agents read every advisory against each member’s own sector, technology, and environment, and guide the member each day on what matters and what to do first.

Threat intelligence has never moved faster. AI, including frontier models that now discover vulnerabilities at machine speed, is multiplying advisories, vulnerabilities, and indicators. A large enterprise absorbs that volume with a dedicated team and platform. But a small corporate IT office, or a cooperative water or electric utility with one security generalist, cannot. For them, more intelligence has meant more noise, not more protection.

Cyware Last Mile Agents are a new class of Cyware AI agents, which power analyst workflows inside the Cyware platform. Cyware AI agents serve the analyst at the hub, and now Cyware’s new Last Mile Agents serve the smaller member organization at the edge. The hub runs the Cyware platform and curates the intelligence; while member organizations connected to those hubs run Last Mile Agents tuned to their own priorities, with no required platform to deploy.

Cyware Last Mile Agents:

  • Priority Intelligence Requirements (PIR) Agent: Captures what matters to each member and continuously matches every incoming advisory and vulnerability against it. It is the foundation that every other Last Mile Agent builds on.
  • Vulnerability Watch Agent: Delivers a daily vulnerability priority list, sorted into act, attend, and track, weighing exploitation activity and severity against the member’s own environment.
  • Threat Briefing Agent: Produces a daily ranked briefing of what deserves attention across the threat landscape, in explicit order and explained against the member’s priorities.

Vulnerability Watch Agent: Delivers a daily vulnerability priority list, sorted into act, attend, and track, weighing exploitation activity and severity against the member’s own environment.

Threat Briefing Agent: Produces a daily ranked briefing of what deserves attention across the threat landscape, in explicit order and explained against the member’s priorities.

The first Cyware Last Mile Agents available today include Vulnerability Watch Agent and Threat Briefing Agent, both powered by the PIR Agent. Cyware plans to build on these initial Last Mile Agents with automated actioning, so every connected organization can move to knowing what specifically matters to them and acting on it. To learn more, register for the Cyware AI Agents webinar at https://go.cyware.com/cyware-ai-agents-webinar.

Leave a comment »

Which of the world’s biggest economies are the least prepared for cyber attacks?

Posted in Commentary with tags on October 22, 2026 by itnerd

Comparitech researchers have publised a new study looking at which of the world’s wealthiest countries are the least prepared for cyber attacks. To find this out, Comparitech measured the national cybersecurity capability and institutional preparedness of the world’s 50 biggest economies.

According to the findings, the size of an economy doesn’t necessarily equate to a country’s ability to deal with cyber attacks. In fact, GDP barely correlates with overall scores.

Key findings include:

  • The top five most-prepared countries were Finland (96.2), Australia (95.2), the Netherlands and Austria (94.7 each), and France (94.6).
  • The five least-prepared countries were Iran (44.2), Mexico (48.5), Pakistan (50.2), Argentina (60.3), and Egypt (61.3).
  • 14 of the 50 countries lacked standalone national cybersecurity legislation and a further eight only had partial legislation.
  • 5 of the 50 countries lacked mandatory incident reporting for attacks on critical infrastructure.
  • 18 of the 50 countries have not signed, ratified, or acceded to the Budapest Convention on Cybercrime.

More details here: https://www.comparitech.com/news/cybersecurity-rankings-by-country-which-of-the-worlds-biggest-economies-are-the-least-prepared-for-cyber-attacks

Leave a comment »

Hackers target dozens of universities in a possible QuickLaunch system exploit

Posted in Commentary with tags on October 22, 2026 by itnerd

Cybernews researchers discovered that attackers targeted numerous universities worldwide, attempting to compromise their login systems and access students’ and teachers’ personal data. The attack was carried out by exploiting QuickLaunch, an AI-powered tool that helps colleges and universities manage student and staff sign-ins to school systems and access to online services.

Key information:

  • At least 42 universities were identified as possible QuickLaunch-related targets, and 40 more were listed as using a different sign-on setup.
  • Attack summaries in the Mandarin language point to Chinese hackers.
  • The discovered server stored a large dataset linked to QuickLaunch environments, including roughly 32,400 unique user records across 1,079 domains, with names, email addresses, and user IDs.
  • The CVE-2024-7097 vulnerability allowed attackers to create unauthorized accounts via the QuickLaunch API, gaining a foothold in the environment.
  • In this specific case, the affected educational institutions face risks beyond just account compromise.

For more information, here’s the full report:

https://cybernews.com/security/hackers-universities-login-data-leak

Leave a comment »

Entuity Software from Park Place Technologies Launches AI Accelerator and Cooling Monitoring Across AMD, Intel and NVIDIA

Posted in Commentary with tags on October 22, 2026 by itnerd

The newest release of Entuity Software™ from Park Place Technologies offers users unprecedented oversight of GPU and cooling infrastructure – the only infrastructure monitoring and management solution capable of doing so across three major vendors.

Entuity V23.0 P03 now monitors GPUs from AMD®, Intel®, and NVIDIA®, alongside the servers, interconnect fabrics and liquid cooling systems that keep AI computing environments running.

According to Gartner research on top AI and Gen AI Infrastructure Barriers, a rack full of AI servers can draw 30kW to 120kW or more, compared with 5kW to 15kW for a standard server rack. The resulting heat load is why power and cooling rank among the top barriers to deploying AI infrastructure on premises. Entuity is designed to help IT teams manage this challenge.

Newer AI chips increasingly rely on direct-to-chip cooling, and when cooling conditions degrade, GPUs can throttle or go offline. Monitoring the cooling systems alongside the GPUs gives teams the context to act early, which is why this release extends GPU monitoring to cooling infrastructure, making Entuity the only platform to do so.

Previous versions offered OS monitoring, but Entuity V23.0 P03 allows customers to specify an IP address within an OS and connect to GPUs for more detailed infrastructure insights.

Entuity also delivers switch-level visibility into the interconnect fabrics linking GPUs together, helping enterprises get ahead of the link failures that are a leading cause of GPU cluster downtime. Entuity can flag early signs of link degradation, so IT teams can act before a failure occurs.

Entuity V23.0 P03 helps IT teams identify issues that have been difficult to detect previously, including:

  • Expose “gray failures” that traditional monitoring can miss, including hardware conditions that may not trigger availability alarms but can gradually reduce AI infrastructure performance over time.
  • Detect GPU hardware degradation before it causes workload failures by monitoring memory health indicators, ECC errors, and other accelerator telemetry that can reveal emerging problems before a GPU goes offline.
  • See thermal conditions before they become production issues by correlating GPU temperatures, power consumption, and cooling-system telemetry to help teams detect conditions that can lead to throttling, instability, or downtime.
  • Reveal underutilized AI infrastructure through visibility into GPU partitions, accelerator instances, memory usage, and utilization metrics that can uncover stranded accelerator capacity.

Entuity customers with active maintenance contracts can upgrade to V23.0 P03 at no additional cost, while new users can be onboarded directly to this latest version of the software.

Entuity V23.0 P03 Highlights:

AI Accelerator/GPU Monitoring

  • Observability for three GPU vendors on one platform; AMD®, Intel®, and NVIDIA®
  • Five object types beneath the server: GPU Device; GPU Instance (MIG, AMD partition, SR-IOV); Compute Instance; GPU Link (NVLink, xGMI, Xe Link, Gaudi); and GPU Fabric Switch
  • In-band plus out-of-band Redfish through iDRAC and iLO (In-band takes priority, so no GPU is counted twice)
  • Monitor ECC corrected and uncorrected; link CRC; replay and recovery; fabric fatal errors; enforced power limit; and PCIe throughput
  • 14 thresholds enabled by default

Liquid Cooling Monitoring

  • Out-of-the-box support for top vendors including ACCELSIUS™, GRC®, nVent®, and ZutaCore®
  • Monitor pump flow, speed, and feedback; supply and return coolant temperature and differential; system and manifold pressure; reservoir level; valve position; and leak detection
  • Roughly 415 telemetry streams across accelerators and cooling

To learn more about Entuity Software and how it can enhance enterprise infrastructure observability, visit www.entuity.com.

.

Leave a comment »