GBHackers on Security | #1 Globally Trusted Cyber Security News Platform

Red Hat disclosed an important OpenShift vulnerability that could let attackers bypass release-image signature checks and introduce malicious payloads into disconnected registries. This issue, tracked as CVE-2026-75939, affects the `openshift/oc-mirror` tool and has a preliminary CVSS v3.1 score of 7.4. Administrators use `oc-mirror` to retrieve release images from upstream sources and then copy them to […]

The post Red Hat OpenShift Flaw Lets Attackers Poison Disconnected Registries With Malicious Releases appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A Linux variant of the BambooToken backdoor uses MQTT as its command-and-control channel, enabling operators to profile compromised hosts, execute shell commands, and transfer files through broker-mediated topics. Analysis of a statically linked x86-64 ELF sample shows that its configuration, task routing, and network payloads are obfuscated with separate XOR routines. The examined sample, SHA-256 […]

The post Linux BambooToken Malware Uses MQTT C2 for Remote Shell Access and File Exfiltration appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical vulnerability in the MaxKB AI knowledge-base platform could let attackers exploit prompt injection and run operating system commands on vulnerable deployments, including directly on the underlying host in some configurations. This flaw, tracked as CVE-2026-77521 and GHSA-f36j-f34j-h3rx, affects MaxKB versions up to and including 2.10.3-lts. The issue has received a maximum CVSS v3.1 […]

The post Critical MaxKB AI Agent Flaw Lets Prompt Injection Execute System Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Master of Malt reported a customer data breach after attackers allegedly compromised an application key linked to Ribon, a third-party BigCommerce app managed by Be A Part Of that identifies itself as a Fastr brand. BigCommerce notified the retailer of the incident on September 18, 2026, prompting Master of Malt to reach out to affected […]

The post Hackers Abuse Stolen BigCommerce App Key to Steal Master of Malt Customer Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A third Chinese threat actor has been linked to phishing campaigns that cloned trusted websites and chained Chrome and Windows zero-day exploits to deploy a previously undocumented backdoor. The activity occurred on September 3 and 4, 2026, while the targeted vulnerabilities remained unpatched in Google Chrome. It followed Volexity’s September 9 disclosure that UTA0560 and […]

The post Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

D-Link has announced a critical stack-based buffer overflow vulnerability affecting the non-US DIR-822A router, identified as CVE-2026-86296. This vulnerability has received a maximum CVSS v3.1 score of 10.0 and a CVSS v4.0 score of 10.0. Furthermore, a public proof-of-concept (PoC) exploit is reportedly available. The company published advisory SAP10516 on September 18 and updated it […]

The post D-Link DIR-822A Router Vulnerability Scores CVSS 10.0 With Public PoC Available appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

NightEagle, an espionage-focused threat group also tracked as APT-Q-95, has expanded its operations from Asian targets to Russian organizations, using a layered intrusion chain that culminates in attempts to compromise Active Directory domain controllers. The campaign illustrates a familiar but dangerous enterprise compromise pattern: attackers do not need a novel zero-day exploit when exposed remote […]

The post NightEagle Uses BlueKeep and DCSync to Move Toward Active Directory Domain Controllers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A sophisticated npm supply-chain campaign has been linked to 10 malicious JavaScript packages that collectively recorded millions of downloads while bypassing npm’s lifecycle-script protections. The operation centers on a counterfeit package named indexed-btree, which impersonates the legitimate sorted-btree library and executes its malware only when an application uses the package at runtime. Unlike conventional npm […]

The post 10 Malicious npm Packages Linked to Runtime Malware Campaign With Millions of Downloads appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A ransomware incident in which attackers used Active Directory Group Policy to disrupt operations without deploying a Windows encryptor or leaving malware running on endpoints. In April 2026, the attackers accessed a FortiGate SSL VPN using compromised domain credentials, then gained domain-admin-equivalent rights. PAYLOAD Ransomware On April 13, Kaspersky’s Global Emergency Response Team (GERT) created […]

The post PAYLOAD Ransomware Abuses Active Directory Group Policy to Disrupt Entire Windows Domain appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A newly identified information-stealing campaign, tracked as Rapuncel, is exploiting a Microsoft-attested kernel driver to terminate up to 145 antivirus (AV) and endpoint detection and response (EDR) processes. This allows attackers to steal browser credentials, cryptocurrency wallet data, chat tokens, and Windows credentials. Researchers from the LastPass Threat Intelligence, Mitigation, and Escalation team, in collaboration […]

The post New Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A recently published proof-of-concept project named BigDiskBuster claims to prevent Microsoft Defender from completing its platform and security intelligence signature updates. This could create a potential denial-of-service condition, leaving Windows endpoints operating with outdated anti-malware protection. The project, published on GitHub by the user “MSNightmare,” is described as a “Windows Defender Update Denial of Service […]

The post BigDiskBuster Windows Defender DoS Vulnerability Blocks Platform and Signature Updates appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

North Korea’s Hangro VPN and mail platform has deployed a new certificate hierarchy that exposes an apparent cross-border management environment spanning systems in Pyongyang and Russia’s Far East. The certificate’s Subject Alternative Name field lists the platform’s publicly exposed servers alongside a carrier-grade NAT address, offering an unusual glimpse into how the service may be […]

The post North Korea’s Hangro VPN Certificate Exposes Internal Network and Russia-Linked Infrastructure appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Threat actors are increasingly abusing Microsoft Teams’ external chat capabilities to impersonate corporate IT help desks. They trick employees into installing malware, granting remote access, and stealing Windows credentials. These attacks exploit a simple vulnerability: employees tend to distrust suspicious emails but often do not apply the same caution to collaboration platforms like Teams. Attackers […]

The post Hackers Abuse Microsoft Teams to Pose as IT Support and Steal Employee Passwords appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Security researchers have unveiled a cache poisoning technique called cache key injection that lets attackers bypass access controls, expose cached sensitive pages, trigger denial-of-service conditions, and potentially execute stored cross-site scripting (XSS) attacks against vulnerable Nginx deployments. Research by YesWeHack researcher Alex Brumen highlights flaws that occur when web caches create cache keys by directly […]

The post New Cache Key Injection Attack Lets Hackers Bypass Access Controls and Poison Nginx Caches appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

North Korea-linked threat actor TraderTraitor has expanded its developer-focused intrusion activity beyond cryptocurrency targets, using weaponized Terraform lock files in fake job-interview repositories to infect DevOps engineers with macOS backdoors. SentinelOne identified an Indian IT services provider compromised with the same FLATROOF and ROOFDECK implants previously linked to the April 2026 KelpDAO-LayerZero attack. The campaign […]

The post Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

“HEIF Heist,” a broad class of image-processing attack paths that could allow threat actors to turn malicious HEIF, HEIC, and AVIF uploads into remote code execution, sensitive-data exposure, and account compromise across major technology and enterprise platforms. The research, published by Hacktron, highlights a familiar but increasingly dangerous supply-chain weakness: applications often trust native image-decoding […]

The post HEIF Heist Image Flaws Let Attackers Gain RCE Across Meta, Slack and GitHub Enterprise appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google has confirmed that its Gemini artificial intelligence model accidentally accessed protected systems belonging to three real companies during a cybersecurity evaluation. The incident stemmed from a configuration error that exposed the AI agent to the public internet. Google Gemini AI Hacked This situation highlights how autonomous AI systems can breach intended testing boundaries when […]

The post Google Gemini AI Hacked 3 Real Companies After Cybersecurity Test Exposed It to Internet appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

North Korean threat actors, known as WaterPlum (also referred to as Contagious Interview), have infected at least 30,000 devices in over 100 countries by luring software developers and IT professionals into malicious job interviews.   This campaign specifically targets web developers, freelancers, blockchain specialists, and cryptocurrency professionals. The attackers use persuasive recruitment messages that mimic legitimate […]

The post North Korean WaterPlum Hackers Target IT Professionals With Fake Job Interviews to Steal Crypto appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Researchers have identified a new Android banking Trojan called RatHat that utilizes artificial intelligence to automate device compromise and steal financial credentials, PINs, and one-time passcodes. Zimperium’s zLabs researchers analyzed this malware, which represents a significant evolution in Android threats. AI-Powered RatHat Android Trojan Unlike traditional malware that relies on fixed scripts, RatHat offers a […]

The post AI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA Codes appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A sophisticated cryptomining campaign is employing multiple layers of obfuscation to conceal malicious PowerShell payloads and ultimately deploy an XMRig-based cryptocurrency miner. This obfuscation includes Windows Registry entries, DNS TXT records, PNG images, and WAV audio files. The infection was detected after repeated security alerts indicated suspicious PowerShell activity. The initial execution command launched PowerShell […]

The post PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.