A newly disclosed security flaw in the Kubernetes Container Storage Interface (CSI) Driver for Network File System (NFS) exposes storage servers to unauthorized directory modification and deletion. Tracked as CVE-2026-3864 with a medium-severity CVSS v3.1 score of 6.5, this vulnerability…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Fake Telegram Download Site Delivers Stealthy In-Memory Malware Loader
A newly discovered malware campaign is exploiting user trust in Telegram by distributing a trojanized installer through a typosquatted website, telegrgam[.]com. The site closely mimics the official Telegram download portal and delivers a malicious executable named tsetup-x64.6.exe, making it appear legitimate…
FortiClient Hit by Severe SQL Injection Vulnerability Enabling Database Intrusion
Cybersecurity researchers have a detailed a critical security flaw in Fortinet’s FortiClient Enterprise Management Server (EMS). Tracked as CVE-2026-21643, this severe pre-authentication SQL injection vulnerability carries a near-maximum CVSS severity score of 9.1. It allows unauthenticated attackers to execute arbitrary…
Judicial Targets Hit by COVERT RAT via Court Docs and GitHub Payloads
Attackers are abusing fake court documents and GitHub‑hosted payloads in a focused spear‑phishing campaign that deploys a stealthy Rust‑based COVERT RAT against Argentina’s judicial sector. This operation chains Windows LNK shortcuts, BAT loaders, and PowerShell to quietly fetch and execute…
AWS Bedrock AgentCore Sandbox Bypass Enables Stealthy C2 and Data Exfiltration
A newly disclosed vulnerability in AWS Bedrock AgentCore Code Interpreter allows threat actors to bypass network isolation and establish stealthy command-and-control (C2) channels. AWS originally advertised this mode as providing complete isolation without external access, researchers found that it permits…
Iranian Hackers Use Compromised Cameras for Regional Surveillance
Iranian cyber actors are expanding operations targeting US organizations while also exploiting internet-connected cameras across the Middle East for intelligence collection and battlefield awareness. Recent incidents tied to APT group MuddyWater, camera‑focused infrastructure, and hacktivist collective Handala point to an…
Google Warns Ransomware Groups Shift to Data Theft as Profits Decline
Google is warning that ransomware gangs are reinventing their business model as traditional encryption‑for‑ransom attacks become less profitable and data‑theft extortion surges. Better cybersecurity controls, improved backup strategies, and stronger recovery capabilities mean more victims can restore their systems without…
Windows 11 25H2/24H2 Update Addresses Bluetooth Device Visibility Issues
Microsoft has rolled out an unexpected out-of-band hotpatch, KB5084897, targeting Windows 11 versions 25H2 and 24H2. Released on March 16, 2026, this specific update resolves a highly disruptive visual bug affecting Bluetooth connectivity management. The patch elevates supported systems to…
Microsoft Launches AI-Driven Troubleshooting for Purview Data Lifecycle Tools
Microsoft has officially released a new open-source tool designed to simplify how IT and security administrators manage data governance. Announced on March 16, 2026, the DLM Diagnostics Model Context Protocol (MCP) Server brings artificial intelligence directly into the troubleshooting process…
Glassworm Malware Infects Popular React Native npm Packages
A new Glassworm-linked supply chain attack has briefly turned two popular React Native npm packages into delivery vehicles for Windows credential-stealing malware. On March 16, 2026, malicious versions of AstrOOnauta’s react-native-country-select@0.3.91 and react-native-international-phone-number@0.11.8 were published to npm, each embedding an…
Angular XSS Vulnerability Threatens Thousands of Web Applications
A high-severity Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-32635, has been discovered in Angular, one of the world’s most widely used web application frameworks. This flaw resides in the Angular runtime and compiler and affects internationalisation (i18n) attribute bindings. If…
Packagist Themes Deliver Trojanized jQuery in OphimCMS Supply Chain Attack
A new OphimCMS supply chain attack in which six Packagist themes ship trojanized jQuery and other JavaScript to compromise site visitors rather than servers. Researchers found six malicious Composer packages under the “ophimcms” namespace on Packagist that pretend to be…
CISA Issues Alert on Wing FTP Server Vulnerability Used in Attacks
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent security alert regarding a critical vulnerability in the Wing FTP Server. On March 16, 2026, the agency officially added this security flaw to its Known Exploited Vulnerabilities (KEV) catalog.…
WebFiling Flaw at UK Companies House Exposed Director Data for Months
The UK Companies House recently disclosed a significant security vulnerability in its WebFiling service that exposed sensitive director information for several months. Chief Executive Andy King confirmed that the flaw was initially introduced during a system update in October 2025.…
Hackers Leverage Safe Links and URL Rewriting to Evade Detection
Threat actors were already abusing URL rewriting mechanisms in phishing campaigns to mask malicious domains. URL rewriting is designed to protect users by replacing original links with security-vendor URLs that scan destinations at click time. These rewritten links route traffic…
Payload ransomware hits Windows and ESXi with Babuk-style encryption
A new ransomware operation called Payload is rapidly emerging as a serious threat to both Windows and VMware ESXi environments, combining Babuk-style cryptography with aggressive anti-forensics and a working double-extortion model. The group claims to have been active since at least February…
Malicious NPM Packages Spread PylangGhost RAT in Supply Chain Attack
Malicious npm packages are delivering the North Korean–linked PylangGhost remote access trojan (RAT) in a new software supply chain campaign that targets developers across Windows, Linux, and macOS systems. The first malicious versions appeared in late February 2026 (@jaime9008/math-service 1.0.1–1.0.2), followed…
Researchers Uncover Ways to Decrypt Palo Alto Cortex XDR BIOC Rules for Evasion
Cybersecurity researchers have discovered a critical evasion technique in Palo Alto Networks’ Cortex XDR agent that allowed attackers to completely bypass behavioral detections. The research demonstrates how predefined Behavioral Indicators of Compromise (BIOC) rules, shipped encrypted by Palo Alto, could…
Hackers Abuse Trusted Websites in New Attacks on Microsoft Teams Users
Threat actors are increasingly turning to trusted infrastructure to launch their attacks, making it harder for automated security tools to flag malicious activity. A newly identified phishing campaign highlights this growing trend by abusing compromised websites to harvest valuable corporate…
LiveChat Support Tools Abused in SaaS Phishing Scheme
A newly identified campaign shows how Software-as-a-Service (SaaS) platforms like LiveChat are being weaponized to steal sensitive data in real time. Unlike traditional phishing attacks that rely on fake login pages or static forms, this tactic uses live chat conversations…