MALFEX, a persistent npm supply-chain campaign distributing Windows malware through eight malicious packages. Linked to an apparent single operator active…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
EY Data Breach Exposes Goldman Sachs and Man Group Clients’ Tax and Financial Data
Ernst & Young (EY) has warned that a data breach exposed personal and financial information belonging to clients of Goldman Sachs’ wealth management…
Critical Progress DataDirect GenAI Flaw Lets Attackers Execute Arbitrary OS Commands
Progress has disclosed a critical command injection vulnerability in the Early Access Release of its DataDirect Autonomous REST Connector AI Model…
FBI Warns FortiBleed Campaign Targeting Fortinet Firewalls and VPNs to Steal Credentials
The FBI and U.S. Secret Service issued a joint cybersecurity advisory warning that operators of “FortiBleed” continue to target internet-facing Fortinet…
Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure
CyberXero, a Russian-speaking initial access broker combining conventional exploitation tools with AI agents to pursue global website compromises and…
Hackers Use ERP Web Shell and IDOR Flaws to Breach Major South Korean Churches
Attackers breached two of South Korea’s largest churches through distinct intrusion chains, combining an ERP web shell, privileged database access, leaked…
Elastic Patches 14 Security Flaws, Including One Enabling Cross-Tenant Data Interception
Elastic published 14 security advisories addressing various vulnerabilities in Elasticsearch, Kibana, and Elastic Agent/Endpoint. Among these, a…
OpenSSH 10.6 Fixes Security Flaws Including SSH Plaintext Recovery Attack
OpenSSH released version 10.6 on October 6, 2026, to address security vulnerabilities that affect encrypted sessions, file transfers, authentication, and…
Critical Veeam Backup & Replication Flaw Allows Low-Privileged Users to Execute Remote Code
Veeam released security updates to address a critical vulnerability that lets low-privileged users execute remote code on Veeam Backup Servers. Identified…
LUNEXSTEALER Gives Hackers Remote Control of Browsers Through Malicious Chrome Extension
A campaign that uses more than 100 compromised websites to distribute LUNEXSTEALER, a Windows infostealer that installs a browser extension giving…
Partisan Zmiy Malware Campaign Uses Telegram and DNS Tunneling to Target Healthcare Networks
A prolonged Partisan Zmiy intrusion into a medical organization, exposing an updated malware toolkit that combined Telegram command channels, DNS…
Best Just-in-Time (JIT) Access Tools Compared (2026): Features & Pricing
Microsoft Entra PIM is the JIT baseline most enterprises already license, Britive leads born-cloud JIT, and ConductorOne/Opal fuse JIT with access…
Earth Sirrush Espionage Activity May Support Sandworm Operations Against Ukraine
Russia-aligned threat actor Earth Sirrush has sustained spear-phishing operations against Ukrainian government, defense, border security, and logistics…
12 Best Certificate Lifecycle Management (PKI) Tools Compared (2026): Features & Pricing
Keyfactor is the best all-in pick for owning PKI and lifecycle together, CyberArk (Venafi) the neutral control plane for multi-CA estates, and Let’s…
12 Best Fine-Grained Authorization Tools Compared (2026): Features & Pricing
Okta’s Auth0 FGA is the best managed anchor for Zanzibar-style authorization, seamlessly complementing modern CIAM solutions across multi-tenant…
12 Best Machine Identity Management Solutions Compared (2026): Features & Pricing
CyberArk (Venafi) is the best machine-identity anchor for enterprise certificate estates, while Keyfactor pairs lifecycle with its own PKI and the…
Tencent Cloud-Linked AI Agent Fleet Bypasses Amap Anti-Bot Protections
Researchers have discovered a fleet of AI agents using Tencent Cloud infrastructure to circumvent Amap’s anti-bot protections and collect entrance-level…
Rockstar Games Attacks Expose MFA Fatigue, OAuth Token Theft and Dev Pipeline Security Failures
Rockstar Games’ breach history illustrates how stolen identities, trusted integrations and exposed development assets can undermine enterprise defenses…
Fake ChatGPT, Claude and Gemini Ads Use Browser-in-the-Browser Phishing to Steal Accounts
A human-operated phishing platform impersonating AI advertising products to steal credentials and manipulate multifactor authentication workflows. The…
Anthropic Opens Claude’s Advanced Cyber Capabilities to Verified Red Teams With Reduced Restrictions
On October 6, 2026, Anthropic announced an expanded Cyber Verification Program (CVP) that gives vetted security professionals access to advanced Claude…