GBHackers on Security | #1 Globally Trusted Cyber Security News Platform

International law enforcement authorities have arrested three suspects linked to the KillSec ransomware group, including a 16-year-old who is alleged to be the operation’s administrator and primary operator. This coordinated action, announced on October 1, involved agencies from nine countries and was supported by Eurojust and Europol. KillSec Ransomware Leader Arrested KillSec, which has been […]

The post 16-Year-Old Suspected KillSec Ransomware Leader Arrested in International Operation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The U.S. Treasury Department has sanctioned a Tren de Aragua (TdA)-linked financial network accused of using malware-driven ATM jackpotting attacks to steal an estimated $40.73 million from U.S. financial institutions. The September 30 action adds eight individuals, two Mexico-based companies, and seven TRON cryptocurrency addresses to the Office of Foreign Assets Control’s (OFAC) Specially Designated […]

The post Tren de Aragua ATM Jackpotting Network Linked to $40.7 Million in U.S. Losses appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The U.S. Federal Trade Commission (FTC) has initiated a broad investigation into OpenAI, Anthropic, and other leading artificial intelligence developers to examine potential consumer harm arising from advanced AI systems. This inquiry will assess whether the companies’ development, deployment, safety claims, and management of agentic AI risks could violate the FTC Act’s prohibition on unfair […]

The post FTC Investigates OpenAI and Anthropic Over Consumer Risks From Advanced AI Models appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A Python-based infostealer builder that enables threat actors to generate customized Windows payloads capable of stealing browser credentials, payment-card data, session cookies, Discord tokens, Wi-Fi passwords and extensive system information. Rather than functioning as a single-use stealer, the package includes a builder interface and an embedded payload, providing a model consistent with Malware-as-a-Service operations. Operators […]

The post New Infostealer Can Steal Passwords, Cards, Cookies and Wi-Fi Keys From Windows PCs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Fortinet has disclosed a critical vulnerability in FortiMail that attackers are actively exploiting to compromise vulnerable email security appliances. This flaw, tracked as CVE-2026-104286, has a CVSS v3.1 score of 9.8. It enables unauthenticated attackers to write arbitrary files to the underlying system via specially crafted HTTP or HTTPS requests. Fortinet FortiMail Path Traversal Flaw […]

The post Fortinet FortiMail Path Traversal Flaw Actively Exploited to Compromise Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Apache HTTP Server administrators are urged to apply security updates following the disclosure of multiple vulnerabilities affecting Apache HTTP Server 2.4. These vulnerabilities include flaws that could allow for remote code execution (RCE), server crashes, memory exhaustion, and other denial-of-service (DoS) conditions. They impact various components of this widely used web server, particularly configurations that […]

The post Apache HTTP Server Flaws Enable Remote Code Execution and Denial-of-Service Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

U.S. authorities have arrested Greg Lui, a 38-year-old California-based technology company owner, on allegations of orchestrating the illegal export of more than $300 million in advanced GPU-equipped servers to China through a network of overseas transshipment companies. Federal prosecutors claim that Lui, also known as Yiu Kong Lui, used false end-user documentation, intermediary companies, and […]

The post U.S. Arrests Company Owner Accused of Shipping $300 Million in Restricted GPU Servers to China appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A newly tracked intrusion set, STAC4924, is using TerminalFix social-engineering lures to deploy the Lorem Ipsum Loader and establish covert reverse tunnels into enterprise environments. The activity shifts the familiar ClickFix model from the Windows Run dialog to Windows Terminal, increasing the likelihood that victims execute complex PowerShell payloads without recognizing the risk. Unlike conventional […]

The post TerminalFix Attacks Deploy Lorem Ipsum Loader to Create Covert Tunnels Into Corporate Networks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical vulnerability in Next.js could let unauthenticated remote attackers execute code on affected servers by supplying crafted input that gets rendered into SVG content during dynamic image generation. This issue, tracked as GHSA-vcvr-r3jv-pc5j, affects the Node.js implementation of ImageResponse in the next/og package. The flaw impacts Next.js versions 16.2.0 to 16.3.5. Vercel has released […]

The post Next.js ImageResponse Vulnerability Lets Remote Attackers Execute Code Through SVG Content appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Axios maintainers have disclosed several high-severity security vulnerabilities that could allow attackers to bypass proxy and DNS controls in server-side applications, potentially enabling server-side request forgery (SSRF) against internal services and cloud metadata endpoints. The most critical issue, tracked as GHSA-3pq3-5fj3-cg6v, affects Axios’s HTTP/2 request path. This vulnerability arises because the HTTP/2 adapter establishes sessions […]

The post Axios Flaws Let Attackers Bypass Proxy Controls and Trigger SSRF Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A China-nexus cyber-espionage campaign that compromised approximately 350 endpoints across Asia using a previously undocumented Rust-based Windows backdoor called Antino. The activity cluster, tracked as UAT-11587, targeted government, defense, diplomatic, policy, academic and civil-society organizations in at least eight countries between September 2025 and July 2026. Talos identified 10 confirmed and five probable affected institutional […]

The post China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

TeamViewer has issued security bulletin TV-2026-1010 to address five high-severity vulnerabilities found in the TeamViewer Full Client, Host, and related services. These vulnerabilities affect deployments on Windows, Linux, and macOS, and include issues such as remote code execution, session permission bypass, arbitrary privileged file writes, and local privilege escalation. Multiple TeamViewer Vulnerabilities CVE-2026-19743 – Path […]

The post Multiple TeamViewer Vulnerabilities Enable RCE, Access Control Bypass and Privilege Escalation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A new macOS backdoor, tracked as CloudSyncD, that masquerades as a Zoom installer and uses invisible Unicode characters to conceal a victim’s phished password inside a seemingly harmless configuration file. The malware was found during routine VirusTotal monitoring embedded in a fake Zoom client distributed as a disk image named “Zoom.” Its visual layout imitates […]

The post CloudSyncD Uses Invisible Unicode to Hide Phished Mac Passwords in Plain Sight appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Security researchers have identified 543,699 unique credentials that remain valid despite being exposed in public GitHub repositories. This highlights a persistent failure to revoke secrets once they enter source code. These credentials were verified as active in July 2026, even though many had been publicly accessible for years. Researchers at Truffle Security examined The Stack […]

The post Researchers Find 543,699 Active Credentials Leaked in Public GitHub Repos appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A newly analyzed WordPress malware family, tracked as SC for the “SC_” markers embedded in its injected code, uses a self-healing persistence mesh that can restore a deleted backdoor within seconds. Researchers found that SC does not rely on a single web shell or plugin. Instead, the malware creates at least eight interdependent persistence points, […]

The post SC WordPress Malware Rebuilds Itself After Removal Using Database and Memory Persistence appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

HPE has released security updates for its Networking Instant On access points after identifying 18 vulnerabilities, including several critical flaws that could allow unauthenticated attackers to execute arbitrary code or commands with privileged operating-system access. These vulnerabilities are detailed in advisory HPESBNW05150 rev. 1 and affect Instant On AP software versions 3.4.1.0 and earlier. HPE […]

The post HPE Instant On AP Flaws Let Unauthenticated Attackers Execute Arbitrary Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

OWASP ModSecurity has disclosed multiple vulnerabilities that could let attackers bypass web application firewall rules, evade request and response inspection, or trigger denial-of-service conditions. Not all of the newly published advisories currently have CVE identifiers; the project has indicated that CVE requests have been submitted via GitHub but remain unassigned for several issues. The recently […]

The post Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cisco has disclosed a critical authentication bypass vulnerability in the Catalyst SD-WAN Manager, which could allow unauthenticated remote attackers to access the management API with administrator privileges. This vulnerability, tracked as CVE-2026-76504, has a CVSS v3.1 score of 9.8 and affects the Cisco Catalyst SD-WAN Manager regardless of its configuration. On September 30, 2026, Cisco […]

The post Critical Cisco SD-WAN Vulnerability Lets Remote Attackers Bypass Authentication as Admin appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Threat actors are increasingly abusing Microsoft Defender Antivirus exclusions to keep malicious files outside the reach of endpoint scans, and a little-known policy setting can conceal those exclusions from administrators using normal management tools. Huntress researchers found that attackers can combine broad Defender exclusions with the HideExclusionsFromLocalAdmins setting, creating a stealthy defense-evasion path that leaves […]

The post Hackers Hide Microsoft Defender Exclusions From Admins to Evade Antivirus Scans appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

An active exploitation of CVE-2026-73570, a high-severity unauthenticated OS command-injection vulnerability in Zimbra Collaboration Suite. Attackers used to obtain root access, establish persistent control, and collect mailbox authentication secrets. The issue resides in Zimbra’s SNMP notification processing path. An attacker can send a specially crafted SMTP request containing shell metacharacters, allowing attacker-controlled input to reach […]

The post Zimbra Vulnerability Exploited to Gain Root Access and Steal Mailbox Authentication Secrets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.