A sophisticated cyber espionage campaign targeting government and diplomatic organizations across Southeast Asia has used a Go-based remote access Trojan, dubbed GoSerpent, to collect sensitive documents for weeks before exfiltrating them via network shares. Researchers first identified the activity in…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Two Scattered Spider Hackers Jailed in UK’s Largest Cybercrime Prosecution
Two alleged leading members of the Scattered Spider cybercrime collective have been sentenced to five years and six months in prison each for their involvement in the 2024 cyberattack on Transport for London (TfL). The National Crime Agency (NCA) described…
Linux Creator Linus Torvalds Rejects Anti-AI Push and Defends LLM Tools
Linux creator and top-level kernel maintainer Linus Torvalds has made it clear that the Linux kernel project will not adopt an anti-AI stance. He believes that large language models and related tools should be assessed based on their technical value…
7-Zip Vulnerability Lets Attackers Trigger Heap Buffer Overflow Using Malicious Files
A newly disclosed vulnerability in 7-Zip could allow attackers to execute arbitrary code by tricking users into opening a specially crafted XZ-compressed file. Tracked as CVE-2026-14266 and identified by Trend Micro’s Zero Day Initiative as ZDI-26-444 (ZDI-CAN-30169), the flaw is…
ACR Stealer Uses ClickFix, WebDAV, and Steganography to Steal Browser Credentials and Tokens
A surge in ACR Stealer activity from late April through mid-June 2026, with operators combining ClickFix social engineering, WebDAV-hosted payloads, PowerShell obfuscation, and steganography to compromise enterprise users. The malware operations rely on ClickFix social-engineering lures to trick victims into…
AnyDesk Zero-Day Flaw Allows Local Attackers to Trigger System-Wide Denial-of-Service
A newly disclosed zero-day vulnerability in AnyDesk has the potential to allow a local attacker to trigger a denial-of-service condition by exploiting the remote-access software’s “Send Support Information” feature. The advisory, tracked as ZDI-26-401 and ZDI-CAN-26645, was published by Trend…
Five-Layer Fileless Malware Uses JScript and PowerShell to Evade AMSI and Load .NET Payload
An active phishing campaign using a five-layer, fileless malware loader to evade Microsoft’s Antimalware Scan Interface (AMSI), static detection controls, and disk-based forensic analysis. The campaign delivers a Windows Script Host JScript payload inside a TAR archive disguised as a…
Top 10 Firewall Solutions Setting New Cybersecurity Standards in 2026
The firewall category is reinventing itself faster than at any point since NGFW arrived and 2026’s leaders aren’t just shipping better boxes, they’re redefining what “firewall” means. Palo Alto Networks is setting the bar for AI-driven inline prevention, Fortinet for hybrid mesh execution, and HPE Juniper for the quantum-safe era, while…
Millions of Shark Robot Vacuums Vulnerable to Unpatched Remote Code Execution Flaw
Millions of internet-connected Shark robot vacuums may be vulnerable to a critical remote code execution (RCE) flaw that could allow attackers to control devices remotely, access onboard cameras, retrieve home maps, and potentially steal stored Wi-Fi credentials. An independent researcher…
New Framework Redefines AI Penetration Testing Around Prompt Injection and Behavioral Objective Violations
A newly proposed framework argues that AI penetration testing must move beyond conventional infrastructure compromise and assess whether an adversary can make an AI-enabled system act against its intended operational purpose. Traditional penetration testing typically measures compromise through outcomes such…
Hackers Exploit SonicWall SMA1000 Zero-Days to Execute Commands as Root
Hackers are actively exploiting two zero-day vulnerabilities in the SonicWall SMA 1000 Series remote access appliances. They are chaining a critical server-side request forgery flaw with a local code injection bug to execute commands with root privileges. Rapid7’s Managed Detection…
OpenAI Unveils GPT-Red AI Model That Automatically Finds Prompt Injection Vulnerabilities
OpenAI has introduced GPT-Red, an automated safety red-teaming model trained to identify and exploit prompt injection weaknesses in AI agents. Prompt injection occurs when malicious instructions hidden in webpages, emails, local files, code repositories, or tool outputs manipulate an AI…
Next.js Announces July Security Release to Fix 4 High-Severity and 5 Medium Flaws
Next.js maintainers have announced a scheduled security release for July to address nine vulnerabilities, four rated high severity and five rated medium severity. The patches are expected to be released on July 20, 2022, and will include updated versions for…
Critical Zoom Workplace Flaw Lets Unauthenticated Attackers Take Over Accounts Remotely
Zoom has disclosed a critical vulnerability in its Windows desktop software that could allow unauthenticated attackers to take over user accounts remotely. This issue, tracked as CVE-2026-53412 and addressed in bulletin ZSB-26014, arises from improper input validation in Zoom Workplace…
Dutch Police and Europol Disrupt Global Investment Scam Infrastructure and Arrest Key Suspects
Dutch police, working with international law-enforcement partners including Europol, have disrupted a sprawling investment-fraud operation alleged to have defrauded victims across multiple countries of more than €100 million every month. The investigation has resulted in arrests in Poland, Cyprus, Belgium,…
CISA Warns of Actively Exploited Oracle E-Business Suite Flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting CVE-2026-46817, an improper privilege management vulnerability in Oracle E-Business Suite that can lead to a takeover of Oracle Payments. The agency added the issue to…
Splunk Enterprise Flaws Expose Stored Credentials and Allow Arbitrary SPL Searches
Splunk has released security updates for three vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. These vulnerabilities could potentially expose stored credential hashes, enable arbitrary Search Processing Language (SPL) searches, and allow files to be written outside of the intended…
Hackers Pair Stolen Wallet Databases With Keychain Passwords for Offline Crypto Theft
A macOS-focused information stealer is combining stolen wallet databases with credentials harvested from the Apple Keychain, browsers, and Apple Notes to conduct offline cryptocurrency theft attempts. Detected by the MistEye security monitoring system, the malware appears designed for broad data…
Critical JetBrains Flaws Impact IntelliJ IDEA, TeamCity, and YouTrack Users
JetBrains has released security updates for IntelliJ IDEA, TeamCity, and YouTrack that address six vulnerabilities, including a critical path traversal issue that could enable code execution in IntelliJ IDEA. The fixes affect core developer tooling, CI/CD infrastructure, and issue-tracking environments,…
Malicious AI Agents Attempt Reverse Shells, Credential Theft, and Persistent SSH Access
AI agents are increasingly crossing the line from generating content to executing actions inside developer workstations, cloud environments, and enterprise systems. New telemetry from Gen’s H1 2026 Threat Report shows that agent runtime controls detected attempts involving reverse shells, credential-file…