In today’s fast-paced software development world, where applications are released at an unprecedented rate, ensuring their security is more critical than ever. Dynamic Application Security Testing (DAST) has emerged as a fundamental practice for modern development teams. DAST tools, often…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Top 10 Best Privileged Access Management (PAM) Companies in 2025
In an increasingly complex digital landscape, where cloud migrations, remote work, and a distributed workforce have become the norm, the traditional security perimeter has all but disappeared. The most valuable and vulnerable assets of any organization are the privileged accounts…
Windows Users Hit by VenomRAT in AI-Driven RevengeHotels Attack
RevengeHotels, also known as TA558, has escalated its long-standing cybercrime campaign by incorporating artificial intelligence into its infection chains, deploying the potent VenomRAT malware against Windows users. Active since 2015, this threat actor has traditionally targeted hotel guests and travelers,…
Threat Actors and Code Assistants: The Hidden Risks of Backdoor Injections
AI code assistants integrated into IDEs, like GitHub Copilot, offer powerful chat, auto-completion, and test-generation features. However, threat actors and careless users can exploit these capabilities to inject backdoors, leak sensitive data, and produce harmful code. Indirect prompt injection attacks…
FinWise Data Breach: 700K Customer Records Accessed by Ex-Employee
A major data breach at American First Finance, LLC has exposed sensitive information for nearly 700,000 customers. The breach, which occurred on May 31, 2024, was discovered over a year later on June 18, 2025. An ex-employee of the financial…
CrowdStrike npm Packages Hit by Supply Chain Attack
A new supply chain attack has compromised multiple npm packages maintained by the crowdstrike-publisher account, marking a worrying continuation of the so-called “Shai-Halud attack.” Developers and organizations using these packages should take immediate action to safeguard credentials and prevent unauthorized…
APT28 Exploits Signal Messenger to Deploy eardShell and Covenant Malware
Sekoia.io’s Threat Detection and Response (TDR) team has uncovered a sophisticated campaign by APT28 that weaponizes Signal Messenger to deploy two previously undocumented malware families—BeardShell and the Covenant framework. In early 2025, a trusted partner supplied samples that did not…
LG WebOS TV Vulnerability Enables Full Device Takeover by Bypassing Authentication
A security vulnerability has been discovered in LG WebOS TV systems that allows attackers to gain complete control over affected devices by bypassing authentication mechanisms. The vulnerability, disclosed during the TyphoonPWN 2025 LG Category competition where it won first place,…
Millions of Customer Records Stolen in Cyberattack on Gucci, Balenciaga, and Alexander McQueen
Luxury retail giant Kering has confirmed a major data breach affecting its top fashion houses, including Gucci, Balenciaga, and Alexander McQueen. The cybercriminal group known as Shiny Hunters claims to have stolen private details tied to as many as 7.4…
WordPress Plugin Vulnerability Let Attackers Bypass Authentication via Social Login
A critical vulnerability in the Case Theme User plugin for WordPress allows unauthenticated attackers to hijack any account on vulnerable sites, including administrative accounts, by exploiting the social login feature. Site owners are urged to update immediately. On May 31,…
AWSDoor: New Persistence Technique Attackers Use to Hide in AWS Cloud Environments
As more companies move their critical systems and data to Amazon Web Services (AWS), attackers are finding new ways to stay hidden inside cloud environments. AWSDoor is a tool designed to simplify and automate persistence techniques in AWS. Persistence lets…
Threat Actors Exploit MCP Servers to Steal Sensitive Data
Unvetted Model Context Protocol (MCP) servers introduce a stealthy supply chain attack vector, enabling adversaries to harvest credentials, configuration files, and other secrets without deploying traditional malware. The Model Context Protocol (MCP)—the new “plug-in bus” for AI assistants—promises seamless integration…
Top 10 Best MSSP (Managed Security Service Providers) in 2025
In today’s complex digital landscape, the volume and sophistication of cyber threats have outpaced the ability of most organizations to manage their security on their own. The escalating costs of in-house security teams, the global cybersecurity skills gap, and the…
Apple Patches 18 Vulnerabilities in visionOS 26 Allowing Access to Sensitive User Data
Apple has released visionOS 26, addressing eighteen security flaws that could allow unauthorized access to sensitive user data. The update, issued on September 15, 2025, covers a wide range of components in the Apple Vision Pro platform. Apple’s policy is…
SmokeLoader Employs Optional Plugins to Steal Data and Launch DoS Attacks
Active since 2011, SmokeLoader (also known as Smoke or Dofoil) has cemented its reputation as a versatile malware loader engineered to deliver second-stage payloads, including trojans, ransomware, and information stealers. Over the years, it has evolved to evade detection and…
New Phoenix Rowhammer Attack Bypasses DDR5 Chip Protections
A new variation of the Rowhammer attack, named Phoenix, breaks through the built-in defenses of modern DDR5 memory modules. Researchers reverse-engineered the in-DRAM protections on SK Hynix chips and found blind spots that let them flip bits despite the most advanced…
AISURU Botnet Fuels Record-Breaking 11.5 Tbps DDoS Attack With 300,000 Hijacked Routers
The newly identified AISURU botnet, leveraging an estimated 300,000 compromised routers worldwide, has been pinpointed as the force behind a record-shattering 11.5 Tbps distributed denial-of-service (DDoS) attack in September 2025. This unprecedented assault eclipses the previous 5.8 Tbps peak seen…
Apple Releases Security Update Patching Multiple Vulnerabilities in iOS 26 and iPadOS 26
Apple has released a comprehensive security update for iOS 26 and iPadOS 26, addressing 27 vulnerabilities across multiple system components. The update, released on September 15, 2025, targets devices including iPhone 11 and later models, along with various iPad generations from iPad…
Microsoft Releases Fix for Windows 11 24H2 Bluetooth Audio Malfunction Affecting Headsets and Speakers
Microsoft has successfully resolved a critical audio compatibility issue that left thousands of Windows 11 version 24H2 users without functioning Bluetooth headsets, speakers, and integrated laptop audio devices. The company released a targeted driver update on September 12, 2025, addressing…
Spring Framework Security Flaws Allow Authorization Bypass and Annotation Detection Issues
A pair of medium-severity vulnerabilities in the Spring Framework and Spring Security libraries were disclosed on September 15, 2025. Both flaws involve the annotation detection mechanism used by Spring Security’s method security features and can lead to authorization bypass in…