A series of vulnerabilities has been discovered in Espressif Systems’ ESP32 devices, specifically affecting the BluFi module within the ESP-IDF framework. BluFi is designed to simplify WiFi configuration using a Bluetooth interface. These flaws, identified by the NCC Group, enable…
Tag: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
AI Operator Agents Helping Hackers Generate Malicious Code
Symantec’s Threat Hunter Team has demonstrated how AI agents like OpenAI’s Operator can now perform end-to-end phishing attacks with minimal human intervention, marking a significant evolution in AI-enabled threats. A year ago, Large Language Model (LLM) AIs were primarily passive…
Researchers Remotely Hack Commercial Trucks & Buses to Unlock Them
Security researchers have issued an urgent warning that commercial trucks and buses are significantly more vulnerable to cybersecurity attacks than passenger vehicles, potentially leading to catastrophic consequences. According to a comprehensive analysis by security experts, trucks represent more attractive targets…
Zoom Team Chat Decrypted, Exposing User Activity Data
Cybersecurity experts have successfully decrypted Zoom Team Chat data, revealing a wealth of information about user activities. This achievement underscores the importance of digital forensics in uncovering hidden digital evidence. The focus on Zoom Team Chat artifacts has shown that,…
Millions of RSA Keys Exposed, Revealing Serious Exploitable Flaws
A recent study has highlighted a significant vulnerability in RSA keys used across the internet, particularly in IoT devices. Researchers collected and analyzed a vast dataset of RSA certificates, revealing that approximately 1 in 172 keys share a factor with…
Android Malware Disguised as DeepSeek Steals Users’ Login Credentials
A recent cybersecurity threat has emerged in the form of Android malware masquerading as the DeepSeek AI application. This malicious software is designed to deceive users into downloading a fake version of the DeepSeek app, which then compromises their device’s…
BlackLock Ransomware Strikes Over 40 Organizations in Just Two Months
In a concerning escalation of cyber threats, the BlackLock ransomware group has executed a series of attacks on over 40 organizations across various sectors in the first two months of 2025. This surge in activity positions BlackLock as one of…
Jaguar Land Rover Hit by HELLCAT Ransomware Using Stolen Jira Credentials
The HELLCAT ransomware group has claimed responsibility for a significant data breach at Jaguar Land Rover (JLR), exposing vast amounts of sensitive data including proprietary documents, source codes, employee information, and partner details. This attack follows a pattern previously observed…
Apple Introduces RCS End-to-End Encryption for iPhone Messages
Apple has announced the integration of end-to-end encryption (E2EE) for Rich Communication Services (RCS) on iPhones. This development follows the introduction of RCS in iOS 18, marking a new era in mobile messaging with enhanced privacy and security features. The…
Hackers Exploit Tomcat Vulnerability to Hijack Apache Servers
A recent and significant cybersecurity threat has emerged involving a critical vulnerability in Apache Tomcat, identified as CVE-2025-24813. This vulnerability allows for remote code execution, potentially allowing hackers to hijack servers running Apache Tomcat. The exploitation of this vulnerability is…
Hackers Use CSS Tricks to Bypass Spam Filters and Monitor Users
Cybersecurity experts have uncovered how hackers use Cascading Style Sheets (CSS) to deceive spam filters and monitor user behavior. This sophisticated technique allows malicious actors to remain under the radar while gaining insights into user preferences and actions. The abuse…
Adobe Acrobat Vulnerabilities Enable Remote Code Execution
A recent disclosure by Cisco Talos’ Vulnerability Discovery & Research team highlighted several vulnerability issues in Adobe Acrobat. All of these vulnerabilities have been addressed by their respective vendors, aligning with Cisco’s third-party vulnerability disclosure policy. For detection of these…
Hackers Target TP-Link Vulnerability to Gain Full System Control
Hackers exploit a vulnerability in TP-Link routers, specifically the TL-WR845N model, to gain full control over the system. This exploit allows unauthorized users to access the root shell credentials, giving them unrestricted access to manipulate and control the router. Here…
Hackers Exploiting Exposed Jupyter Notebooks to Deploy Cryptominers
Cado Security Labs has identified a sophisticated cryptomining campaign exploiting misconfigured Jupyter Notebooks, targeting both Windows and Linux systems. The attack utilizes multiple stages of obfuscation, including encrypted payloads and COM object manipulation, to ultimately deploy miners for various cryptocurrencies…
AWS SNS Exploited for Data Exfiltration and Phishing Attacks
Amazon Web Services’ Simple Notification Service (AWS SNS) is a versatile cloud-based pub/sub service that facilitates communication between applications and users. While its scalability and integration capabilities make it a powerful tool for organizations, its misuse by adversaries for malicious…
Edimax Camera RCE Vulnerability Exploited to Spread Mirai Malware
A recent alert from the Akamai Security Intelligence and Response Team (SIRT) has highlighted the exploitation of a severe command injection vulnerability in Edimax Internet of Things (IoT) devices. This vulnerability, designated as CVE-2025-1316, has been actively used by multiple…
New Context Compliance Exploit Jailbreaks Major AI Models
Microsoft researchers have uncovered a surprisingly straightforward method that can bypass safety guardrails in most leading AI systems. In a technical blog post published on March 13, 2025, Microsoft’s Mark Russinovich detailed the “Context Compliance Attack” (CCA), which exploits the…
DeepSeek R1 Jailbreaked to Create Malware, Including Keyloggers and Ransomware
The increasing popularity of generative artificial intelligence (GenAI) tools, such as OpenAI’s ChatGPT and Google’s Gemini, has attracted cybercriminals seeking to exploit these technologies for malicious purposes. Despite the guardrails implemented by traditional GenAI platforms to prevent misuse, cybercriminals have…
Cisco Warns of Critical IOS XR Vulnerability Enabling DoS Attacks
Cisco has issued a security advisory warning of a vulnerability in its IOS XR Software that could allow attackers to launch denial-of-service (DoS) attacks. The vulnerability, identified as CVE-2025-20115, affects the Border Gateway Protocol (BGP) confederation implementation. The CVE-2025-20115 vulnerability…
Critical ruby-saml Vulnerabilities Allow Attackers to Bypass Authentication
A critical security vulnerability has been identified in the ruby-saml library, a popular tool used for Single Sign-On (SSO) via Security Assertion Markup Language (SAML) on the service provider side. The vulnerabilities, designated as CVE-2025-25291 and CVE-2025-25292, allow attackers to…
Lazarus Group Weaponizes IIS Servers for Deploying Malicious ASP Web Shells
The notorious Lazarus group has been identified as leveraging compromised IIS servers to deploy malicious ASP web shells. These sophisticated attacks have been reported to facilitate the spread of malware, including the LazarLoader variant, and utilize privilege escalation tools to…
Ongoing Cyber Attack Mimic Booking.com to Spread Password-Stealing Malware
Microsoft Threat Intelligence has identified an ongoing phishing campaign that began in December 2024, targeting organizations in the hospitality industry by impersonating the online travel agency Booking.com. The campaign, tracked as Storm-1865, employs a sophisticated social engineering technique called ClickFix…
U.S. Charges LockBit Ransomware Developer in Cybercrime Crackdown
The U.S. Department of Justice has charged Rostislav Panev, a dual Russian and Israeli national, for his role as a developer of the notorious LockBit ransomware group. Panev, 51, was arrested in Israel in August following a U.S. provisional arrest…
CISA Releases Security Advisory on 13 Industrial Control System Threats
CISA issued thirteen Industrial Control Systems (ICS) advisories, highlighting current security issues and vulnerabilities in various systems. These advisories are crucial for maintaining the security and integrity of industrial operations. The affected products primarily include several Siemens systems, along with…
New Microsoft 365 Attack Leverages OAuth Redirection for Credential Theft
Threat researchers at Proofpoint are currently tracking two sophisticated and highly targeted cyber-attack campaigns that are utilizing OAuth redirection mechanisms to compromise user credentials. These attacks combine advanced brand impersonation techniques with malware proliferation, focusing on Microsoft 365-themed credential phishing…
Decrypting Akira Ransomware on Linux/ESXi Without Paying Hackers
A team successfully decrypted an instance of the Akira ransomware on Linux/ESXi systems without succumbing to the hackers’ demands. This achievement not only underscores the ingenuity of cybersecurity experts but also serves as a powerful message to those who rely…
New Cyber Attack Targets PyPI Users to Steal Cloud Tokens and Sensitive Data
A recent discovery by ReversingLabs researchers has unveiled a malicious cyber attack targeting the Python Package Index (PyPI) users, a popular platform for Python developers. This sophisticated campaign involves malicious packages masquerading as time-related utilities, but are designed to steal…
Blind Eagle Targets Organizations with Weaponized .URL Files to Steal User Hashes
In a significant development in the cybersecurity landscape, APT-C-36, more commonly known as Blind Eagle, has intensified its operations targeting Colombian governmental, financial, and critical infrastructure organizations. Active since 2018, this Advanced Persistent Threat group has recently expanded its arsenal…
86,000+ Healthcare Staff Records Exposed Due to AWS S3 Misconfiguration
A non-password-protected database belonging to ESHYFT, a New Jersey-based HealthTech company, was recently discovered by cybersecurity researcher Jeremiah Fowler. The database contained over 86,000 records, amounting to 108.8 GB of sensitive information. This data breach, while not attributed to intentional…
Microsoft Finally Patches 2-Year-Old Windows Kernel Security Flaw
Microsoft has released a critical patch for a 2-year-old Windows kernel security vulnerability. This vulnerability, identified as CVE-2025-24983, allows attackers to exploit a weakness in the Windows Win32 Kernel Subsystem, leading to an elevation of privilege. The patch comes after…
North Korean Hackers Use Google Play Malware to Steal SMS, Calls & Screenshots
Cybersecurity researchers at Lookout Threat Lab have uncovered a sophisticated Android surveillance tool dubbed “KoSpy,” which appears to be the work of North Korean state-sponsored hackers. This newly discovered spyware has been active since March 2022, with the most recent…
Hackers Exploiting JSPSpy To Manage Malicious Webshell Networks
Cybersecurity researchers have recently identified a cluster of JSPSpy web shell servers featuring an unexpected addition, Filebroser, a rebranded version of the open-source File Browser file management tool. This discovery sheds light on how attackers continue to leverage web shells…
Mozilla Issues Urgent Firefox Update Warning to Prevent Add-on Failures
Mozilla has issued an urgent warning to all Firefox users, emphasizing the need to update their browsers before a critical root certificate expires on March 14, 2025. This certificate is used to verify signed content and add-ons across various Mozilla…
Hackers Exploit Microsoft Copilot for Advanced Phishing Attacks
Hackers have been targeting Microsoft Copilot, a newly launched Generative AI assistant, to carry out sophisticated phishing attacks. This campaign highlights the risks associated with the widespread adoption of Microsoft services and the challenges that come with introducing new technologies…
New DCRat Campaign Uses YouTube Videos to Target Users
A new campaign involving the DCRat backdoor has recently been uncovered, leveraging YouTube as a primary distribution channel. Since the beginning of the year, attackers have been using the popular video-sharing platform to target users by creating fake or stolen…
Bitdefender Identifies Security Vulnerabilities Enabling Man-in-the-Middle Exploits
Cybersecurity firm Bitdefender has disclosed two high-severity security vulnerabilities affecting its legacy BOX v1 device, exposing users to potential remote code execution and man-in-the-middle attacks. The vulnerabilities, identified on March 12th, 2025, affect a product that is no longer sold…
FreeType Vulnerability Actively Exploited for Arbitrary Code Execution
A significant vulnerability has been identified in the FreeType library, a widely used open-source font rendering engine. This vulnerability tracked as CVE-2025-27363, is being actively exploited and may lead to arbitrary code execution on affected systems. Overview of the Vulnerability:…
Fake CAPTCHA Malware Exploits Windows Users to Run PowerShell Commands
In early February 2025, Trustwave SpiderLabs uncovered a resurgence of a malicious campaign leveraging fake CAPTCHA verifications to deliver malware. This campaign uses deceptive CAPTCHA prompts to trick users into executing PowerShell commands, initiating a multi-stage attack chain. The end…
New OBSCURE#BAT Exploit Windows Alters System Processes & Registry for Evasion
Cybersecurity researchers at Securonix have identified an advanced malware campaign that employs social engineering tactics and heavily obfuscated code to deploy rootkits capable of cloaking malicious activities on compromised systems. Dubbed OBSCURE#BAT, the campaign targets English-speaking users through various deception…
North Korean Hackers Deploy DocSwap Malware Disguised as Security Tool
In a recent cybersecurity threat discovery, the S2W Threat Research and Intelligence Center Talon has identified and analyzed a new type of malware linked to a North Korean-backed Advanced Persistent Threat (APT) group. The malware, masquerading as a “문서열람 인증…
Medusa Ransomware Hits 300+ Critical Infrastructure Organizations Worldwide
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have issued a joint advisory on the Medusa ransomware, a ransomware-as-a-service (RaaS) variant that has been active since June…
Tenda AC7 Vulnerability Lets Hackers Execute Malicious Payloads for Root Access
A vulnerability has been discovered in the Tenda AC7 router, firmware version V15.03.06.44, which allows attackers to execute malicious payloads and gain root access. As per a report in Github, the vulnerability, identified through experimental setup and exploitation, revolves around…
GitLab Identifies Security Vulnerabilities Enabling Attacker Logins as Valid Users
GitLab announced the release of versions 17.9.2, 17.8.5, and 17.7.7 for both its Community Edition (CE) and Enterprise Edition (EE). These updates include crucial bug and security fixes, urging all self-managed installations to upgrade promptly to protect against several critical…
Fortinet Addresses Security Issues in FortiSandbox, FortiOS, and Other Products
Fortinet’s Product Security Incident Response Team (PSIRT) announced the resolution of several critical and high-severity security vulnerabilities affecting various Fortinet products, including FortiSandbox and FortiOS. These updates are part of Fortinet’s ongoing efforts to enhance the security and reliability of…
Chinese Hacked Exploit Juniper Networks Routers to Implant Backdoor
Cybersecurity researchers have uncovered a sophisticated cyber espionage campaign targeting critical network infrastructure, marking a significant evolution in tactics by Chinese state-sponsored hackers. Mandiant, a leading cybersecurity firm, has discovered multiple custom backdoors deployed on Juniper Networks‘ routers, attributing the…
U.S. Accuses 12 Chinese Nationals of Hacking National Security Networks
The United States has taken significant steps to address the growing threat of Chinese cyber intrusions into U.S. government agencies and critical infrastructure. On March 5, the U.S. Department of Justice (DOJ) indicted 12 Chinese nationals and one Chinese company…
CISA Issues Advisory on Windows NTFS Flaw Enabling Local Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory regarding a significant vulnerability in the Microsoft Windows New Technology File System (NTFS). This security flaw, identified as CVE-2025-24993, involves a heap-based buffer overflow vulnerability. The vulnerability could…
MirrorFace APT Using Custom Malware To Exploited Windows Sandbox & Visual Studio Code
The cybersecurity landscape witnessed a significant development when the National Police Agency (NPA) and the National center of Incident readiness and Strategy for Cybersecurity (NISC) released a security advisory on January 8, 2025. This advisory highlighted an Advanced Persistent Threat…
CISA Issues Security Alert on Windows NTFS Exploit Risk
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning regarding a recently discovered vulnerability in Microsoft’s Windows New Technology File System (NTFS). Identified as CVE-2025-24991, this security flaw could potentially lead to unauthorized access to sensitive data…
CISA Warns of Exploitable Fast FAT Vulnerability in Microsoft Windows
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a critical vulnerability in the Microsoft Windows Fast FAT File System Driver. This vulnerability, identified as CVE-2025-24985, poses a significant threat as it involves an integer overflow or…
CISA Warns of Microsoft Windows Win32 Kernel Subsystem Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) highlighted a critical vulnerability affecting the Microsoft Windows Win32 kernel subsystem. Identified as CVE-2025-24983, this use-after-free vulnerability in the Win32k component could potentially allow an authorized attacker to locally elevate privileges. The vulnerability…
Microsoft Patch Tuesday March 2025 – 6 Actively Exploited Zero-Days & 57 Vulnerabilities Are Fixed
Microsoft has rolled out its March 2025 Patch Tuesday update, addressing a total of 57 vulnerabilities across its software ecosystem, including 6 actively exploited Zero-day vulnerabilities. This release includes fixes for: Issued on the second Tuesday of each month, this…
Java Axios Package Vulnerability Threatens Millions of Servers with SSRF Exploit
A critical security issue has been identified in the Axios package for JavaScript, which poses significant risks to millions of servers due to server-side request forgery (SSRF) and credential leakage. This vulnerability occurs when absolute URLs are used in Axios…
DCRat Malware Spreading via YouTube to Steal Login Credentials
Cybersecurity researchers have identified a renewed wave of attacks involving the Dark Crystal RAT (DCRat), a dangerous remote access Trojan that has resurfaced through a Malware-as-a-Service (MaaS) model. Attackers are actively targeting gamers by distributing malicious software disguised as gaming…
Fully Undetected Anubis Malware Enables Hackers to Execute Remote Commands
A recent alert has highlighted the emergence of the AnubisBackdoor, a Python-based backdoor attributed to the Savage Ladybug group, which is reportedly linked to the notorious FIN7 cybercrime gang. This malware is designed to provide remote access, execute commands, and…
PHP XXE Injection Vulnerability Allows Attackers to Access Config Files & Private Keys
A newly uncovered XML External Entity (XXE) injection vulnerability in PHP has demonstrated how attackers can bypass multiple security mechanisms to access sensitive configuration files and private keys. The vulnerability, detailed by web application security researcher Aleksandr Zhurnakov, highlights the…
Over 400 IPs Actively Exploiting Multiple SSRF Vulnerabilities in the Wild
A recent surge in Server-Side Request Forgery (SSRF) exploitation has been detected by GreyNoise, highlighting the ongoing threat posed by these vulnerabilities. GreyNoise observed a coordinated increase in SSRF attacks, with at least 400 unique IPs actively exploiting multiple SSRF-related…
Hackers Exploit Advanced MFA Bypass Techniques to Compromise User Accounts
In recent years, phishing has remained the most prevalent form of cyberattack, with approximately 1.2% of global email traffic being phishing attempts, amounting to about 3.4 billion emails daily. Despite a low success rate, with only 3% of employees clicking…
Enhanced XCSSET Malware Targets macOS Users with Advanced Obfuscation
Microsoft Threat Intelligence has recently uncovered a new variant of the XCSSET malware, a sophisticated modular macOS malware known for infecting Xcode projects. This latest iteration features enhanced obfuscation methods, updated persistence mechanisms, and new infection strategies, making it more…
Chinese Hackers Deploy New ‘Squidoor’ Malware to Target Global Organizations
A recent cybersecurity threat has emerged in the form of a sophisticated backdoor malware named Squidoor, attributed to a suspected Chinese threat actor. This malware has been targeting various sectors globally, including governments, defense, telecommunications, education, and aviation, particularly in…
Jaguar Land Rover Allegedly Hacked – 700 Internal Documents Including Source Code Leaked
A threat actor known as “Rey” has come forward on a prominent dark web forum, claiming responsibility for a significant cyberattack on Jaguar Land Rover. The British multinational automotive company, renowned for its luxury and off-road vehicles, is said to…
CISA Warns of Windows NTFS Vulnerability Exploited for Data Theft
The Cybersecurity and Infrastructure Security Agency (CISA) highlighted a critical vulnerability in Microsoft Windows’ New Technology File System (NTFS). The vulnerability, designated as CVE-2025-24984, pertains to an information disclosure issue that could potentially allow attackers to access sensitive data stored…
Jaguar Land Rover Allegedly Hit by Cyberattack, Hacker Claims
A threat actor known as “Rey” has come forward on a prominent dark web forum, claiming responsibility for a significant cyberattack on Jaguar Land Rover. The British multinational automotive company, renowned for its luxury and off-road vehicles, is said to…
Zoom Client Security Flaws Could Lead to Data Breaches
Recent security bulletins from Zoom have highlighted several high-severity vulnerabilities in their client software, raising concerns about potential data breaches for users. The latest security updates, issued on March 11, 2025, address multiple critical issues that could impact the privacy…
CISA Alerts on Active Exploitation of Microsoft Windows MMC Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the active exploitation of a significant vulnerability in Microsoft Windows affecting the Microsoft Management Console (MMC). This security threat underscores the ongoing challenges faced by organizations in managing vulnerabilities and…
macOS NULL Pointer Dereference Vulnerability Allow Attackers Exploits Kernel
Historically, NULL pointer dereferences have been a significant vulnerability in operating systems, including macOS. These occur when software attempts to access memory at address 0 via a NULL pointer, leading to potential crashes or, under certain conditions, exploitation by attackers.…
Ebyte Ransomware Targets Windows Users with Advanced Encryption Techniques
A new ransomware variant, known as Ebyte Ransomware, has emerged as a significant threat to Windows users. Developed in the Go programming language, this ransomware employs sophisticated encryption techniques, including ChaCha20 and Elliptic Curve Integrated Encryption Scheme (ECIES), to lock…
Threat Actors Evade Security Measures to Launch SIM Swap Attacks
SIM swapping fraud continues to pose a significant threat to individuals and financial institutions, despite ongoing efforts by telecom providers and regulatory bodies to enhance security measures. This type of fraud involves fraudsters gaining control of a victim’s phone number…
Apache Camel Vulnerability Allows Attackers to Inject Arbitrary Headers
A newly disclosed security vulnerability in Apache Camel, tracked as CVE-2025-27636, has raised alarms across the cybersecurity community. The flaw allows attackers to inject arbitrary headers into Camel Exec component configurations, potentially enabling remote code execution (RCE). The vulnerability impacts several…
SCADA Vulnerabilities Allow Attackers to Cause DoS and Gain Elevated Privileges
A recent security assessment by Palo Alto Networks’ Unit 42 has uncovered multiple vulnerabilities in the ICONICS Suite, a widely used Supervisory Control and Data Acquisition (SCADA) system. These vulnerabilities, identified in versions 10.97.2 and earlier for Microsoft Windows, pose…
Blind Eagle Hackers Exploit Google Drive, Dropbox & GitHub to Evade Security Measures
In a recent cyber campaign, the notorious threat actor group Blind Eagle, also known as APT-C-36, has been leveraging trusted cloud platforms like Google Drive, Dropbox, GitHub, and Bitbucket to distribute malware and evade traditional security defenses. This sophisticated approach…
AI Becomes a Powerful Weapon for Cybercriminals to Launch Attacks at High Speed
Artificial intelligence (AI) has emerged as a potent tool in the arsenal of cybercriminals, enabling them to execute attacks with unprecedented speed, precision, and scale. The integration of AI in cybercrime is transforming the landscape of digital threats, making traditional…
AI-Generated Fake GitHub Repositories Steal Login Credentials
A concerning cybersecurity threat has emerged with the discovery of AI-generated fake GitHub repositories designed to distribute malware, including the notorious SmartLoader and Lumma Stealer. These malicious repositories, crafted to appear legitimate, exploit GitHub’s trusted reputation to deceive users into…
Google Warns Chromecast Owners Against Factory Reset
Google has issued a warning to Chromecast owners regarding the potential risks of performing a factory reset on their devices. This advisory comes as users have reported complications with device authentication after restoring their Chromecasts to factory settings. The warning…
PoC Released for SolarWinds Web Help Desk Vulnerability Exposing Passwords
A Proof-of-Concept (PoC) has been released for a significant vulnerability discovered in SolarWinds Web Help Desk, exposing encrypted passwords and other sensitive data. This vulnerability arises from the predictable encryption keys used in the application and the misuse of AES-GCM…
“Eleven11bot” Botnet Compromises 30,000 Webcams in Massive Attack
Cybersecurity experts have uncovered a massive Distributed Denial-of-Service (DDoS) botnet known as “Eleven11bot.” This new threat, discovered by Nokia’s Deepfield Emergency Response Team (ERT), shared in LinkedIn, has compromised a staggering 30,000 network devices, predominantly webcams and Network Video Recorders…
Hackers Compromise Windows Systems Using 5000+ Malicious Packages
A recent analysis by FortiGuard Labs has revealed a significant increase in malicious software packages, with over 5,000 identified since November 2024. These packages employ sophisticated techniques to evade detection and exploit system vulnerabilities, posing a substantial threat to Windows…
CISA Added 3 Ivanti Endpoint Manager Bugs to Wildly Exploited Vulnerabilities Catalog
The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog with the addition of three high-risk security flaws affecting Ivanti Endpoint Manager (EPM). These vulnerabilities, which involve absolute path traversal issues, have been observed being…
Lazarus Hackers Exploit 6 NPM Packages to Steal Login Credentials
North Korea’s Lazarus Group has launched a new wave of attacks targeting the npm ecosystem, compromising six packages designed to steal login credentials and deploy backdoors. The malicious packages is-buffer-validator, yoojae-validator, event-handle-package, array-empty-validator, react-event-dependency, and auth-validator have collectively been downloaded…
Apache Pinot Vulnerability Allows Attackers to Bypass Authentication
A significant security vulnerability affecting Apache Pinot, an open-source distributed data store designed for real-time analytics, has been publicly disclosed. The flaw, identified as CVE-2024-56325, allows remote attackers to bypass authentication on vulnerable installations, posing a critical threat to affected systems.…
SideWinder APT Deploys New Tools in Attacks on Military & Government Entities
The SideWinder Advanced Persistent Threat (APT) group has been observed intensifying its activities, particularly targeting military and government entities across various regions. This group, known for its aggressive expansion beyond traditional targets, has recently updated its toolset to include sophisticated…
SAP Security Update Released to Fix Multiple Vulnerabilities
SAP announced 21 new Security Notes and updates to 3 previously released notes on its latest Security Patch Day. This release addresses critical vulnerabilities within SAP products, underscoring the company’s commitment to safeguarding enterprise software. SAP strongly recommends customers prioritize…
Critical Veritas Vulnerability Allows Attackers to Execute Malicious Code
A critical vulnerability has been discovered in Veritas’ Arctera InfoScale product, a solution widely used for disaster recovery and high availability scenarios. The issue lies in the insecure deserialization of untrusted data in the .NET remoting endpoint, allowing attackers to…
Latest Chrome Update Addresses Multiple High-Risk Security Issues
Google has released a critical update for its Chrome browser, advancing the stable channel to version 134.0.6998.88 for Windows, Mac, and Linux, and 134.0.6998.89 for Windows and Mac on the Extended Stable channel. This update includes several high-priority security fixes…
Apache Tomcat Flaw Could Allow RCE Attacks on Servers
Apache Tomcat, a widely used open-source web server software, has faced numerous security vulnerabilities in recent years. Some critical issues put servers at risk of remote code execution (RCE) and other attacks. These vulnerabilities highlight the importance of keeping software…
Critical Microsoft’s Time Travel Debugging Tool Vulnerability Let Attackers Mask Detection
Microsoft’s Time Travel Debugging (TTD) framework, a powerful tool for recording and replaying Windows program executions, has been found to harbor subtle yet significant bugs in its CPU instruction emulation process, according to a new report from Mandiant. These flaws…
ServiceNow Acquires Moveworks for $2.85 Billion to Boost AI Capabilities
In a landmark move to strengthen its position in the rapidly evolving artificial intelligence landscape, ServiceNow, a leading provider of digital workflow solutions, has announced its acquisition of Moveworks, an AI startup, for $2.85 billion. The deal, revealed on Monday,…
Apple iOS 18.4 Beta 3 Released – What’s New!
Apple has rolled out iOS 18.4 Beta 3, available to developers as of March 10, 2025, with the build number 22E5222f. This release is part of the ongoing beta testing phase, with the final version anticipated in early April 2025.…
Ragnar Loader Used by Multiple Ransomware Groups to Bypass Detection
Ragnar Loader, a sophisticated toolkit associated with the Ragnar Locker ransomware group, has been instrumental in facilitating targeted cyberattacks on organizations since its emergence in 2020. This malware is part of the Monstrous Mantis ransomware ecosystem and is designed to…
North Korean Hackers Use ZIP Files to Deploy Malicious PowerShell Scripts
North Korean state-sponsored hackers, known as APT37 or ScarCruft, have been employing sophisticated tactics to breach systems, leveraging malicious ZIP files containing LNK files to initiate attacks. These LNK files, often disguised as documents related to North Korean affairs or…
Researcher Hacks Embedded Devices to Uncover Firmware Secrets
In a recent exploration of embedded device hacking, a researcher demonstrated how to extract firmware from flash memory using the flashrom tool. This process is crucial for understanding device operation and identifying potential vulnerabilities. However, it involves risks that can…
Android Zygote Injection Flaw Lets Attackers Execute Code & Gain Elevated Privileges
A significant vulnerability in the Android operating system, identified as CVE-2024-31317, has been discovered, allowing attackers to exploit the Zygote process for system-wide code execution and privilege escalation. This flaw affects devices running Android 11 or older, highlighting a critical…
Threat Actors Exploit EncryptHub for Multi-Stage Malware Attacks
EncryptHub, a rising cybercriminal entity, has been under scrutiny by multiple threat intelligence teams, including Outpost24’s KrakenLabs. Recent investigations have uncovered previously unseen aspects of EncryptHub’s infrastructure and tactics, revealing a sophisticated multi-stage malware campaign. The threat actor’s operational security…
New Linux Kernel Code Written in Rust Aims to Eliminate Memory Safety Bugs
The integration of Rust into the Linux kernel is a significant step forward in enhancing memory safety, a critical aspect of kernel development. This effort, known as Rust for Linux, began in 2021 with the publication of an RFC by…
North Korean IT Workers Linked to 2,400 Astrill VPN IP Addresses
new data has emerged linking over 2,400 IP addresses associated with Astrill VPN to individuals believed to be North Korean IT workers. These findings were reported by a cyber security source, who obtained the information from http://Spur.us, a platform known for…
Laravel Framework Flaw Allows Attackers to Execute Malicious JavaScript
A significant vulnerability has been identified in the Laravel framework, specifically affecting versions between 11.9.0 and 11.35.1. The issue revolves around improper encoding of request parameters on the error page when the application is running in debug mode, leading to…
Critical Vulnerabilities in Moxa Switches Enable Unauthorized Access
A critical vulnerability identified as CVE-2024-12297 has been discovered in Moxa’s PT series of network switches, affecting multiple models across different product lines. This security flaw involves an authorization logic disclosure that can be exploited to bypass authentication mechanisms, allowing…
Cobalt Strike Exploitation by Hackers Drops, Report Reveals
A collaborative initiative involving Microsoft’s Digital Crimes Unit (DCU), Fortra, and the Health Information Sharing and Analysis Center (Health-ISAC) has reported a major drop in the use of unauthorized versions of the cyber tool Cobalt Strike by hackers. Since the…
Developer Pleads Guilty to Injecting Malware and Crippling Company Systems
In a stunning case of corporate sabotage, a former software developer for Eaton Corp., Davis Lu, 55, of Houston, has been found guilty by a jury of intentionally damaging the company’s internal computer systems. This malicious act occurred after his…
WinDbg Vulnerability Allows Attackers to Execute Remote Code
Microsoft recently disclosed a critical vulnerability impacting its debugging tool, WinDbg, and associated .NET packages. Tracked CVE-2025-24043, this flaw allows remote code execution (RCE) due to improper cryptographic signature verification in the SOS debugging extension. According to Github’s Post, Developers…