A newly discovered vulnerability in the AI supply chain—termed Model Namespace Reuse—permits attackers to achieve Remote Code Execution (RCE) across major AI platforms, including Microsoft Azure AI Foundry, Google Vertex AI, and thousands of open-source projects. By re-registering abandoned or…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Dire Wolf Ransomware Targets Windows, Wipes Logs and Backups
The recently emerged DireWolf ransomware group has launched a sophisticated new campaign targeting Windows systems worldwide, employing ruthless tactics to delete event logs, erase backup-related data, and thwart recovery efforts. First sighted in May 2025, DireWolf has rapidly escalated its…
Over 1,100 Ollama AI Servers Found Online, 20% at Risk
More than 1,100 instances of Ollama—a popular framework for running large language models (LLMs) locally—were discovered directly accessible on the public internet, with approximately 20% actively hosting vulnerable models that could be exploited by unauthorized parties. Cisco Talos specialists made…
Apache DolphinScheduler Vulnerability Patched — Update Immediately
A low-severity security issue in Apache DolphinScheduler has been addressed in the latest release. Identified as CVE-2024-43166 and classified under CWE-276: Incorrect Default Permissions, this vulnerability affects all DolphinScheduler versions prior to 3.2.2. Users are strongly advised to upgrade to…
Chrome 140 Release Fixes Critical RCE Vulnerabilities
Google has released Chrome 140 to the stable channel for Windows, Mac, and Linux. This update will roll out to users over the coming days and weeks. The new version, 140.0.7339.80 for Linux and 140.0.7339.80/81 for Windows and Mac, delivers…
NVIDIA Patches Vulnerabilities Causing DoS, EoP, and Data Exposure
NVIDIA today released critical security updates for its BlueField, ConnectX, DOCA, Mellanox DPDK, Cumulus Linux, and NVOS products. The Partner Security Bulletin addresses multiple vulnerabilities that could allow denial of service (DoS), escalation of privileges (EoP), and information disclosure. Customers…
Google Avoids Chrome Breakup but Must Share Search Data With Competitors
The U.S. District Court for the District of Columbia today imposed landmark remedies in the Justice Department’s monopolization case against Google, ordering the tech giant to share critical search data with competitors and outlawing exclusive distribution agreements for its flagship…
MystRodX: Weaponizing DNS and ICMP for Data Theft
A sophisticated backdoor, MystRodX, that exploits DNS and ICMP protocols to stealthily activate and exfiltrate data from compromised systems. Deployed via a dropper disguised as a Mirai variant, MystRodX remained undetected for over 20 months by hiding its activation logic…
Empire Red Teaming Tool Updated With Enhanced Agents and API Support
The BC-SECURITY team has released a major update to its flagship offensive security framework, Empire, introducing enhanced agent capabilities and comprehensive API support designed to streamline post-exploitation operations and adversary emulation for Red Teams and penetration testers worldwide. Enhanced Features Drive…
Google Cloud & Cloudflare Missed 3-Year Phishing Campaign
An industrial-scale phishing campaign exploiting Google Cloud and Cloudflare infrastructure operated in plain sight for more than three years, targeting Fortune 500 companies and siphoning millions in potential revenue while evading detection. Deep Specter Research’s investigation reveals the depth of…
CISA Alerts on Critical SunPower Vulnerability Allowing Full Device Takeover
The Cybersecurity and Infrastructure Security Agency (CISA) yesterday issued a high-severity alert (ICSA-25-245-03) regarding a critical vulnerability in SunPower’s PVS6 solar inverter series that allows attackers on adjacent networks to gain complete control of the device. Rated 9.4 out of…
New BruteForceAI Tool Automates Login Page Detection and Attacks
A cutting-edge penetration testing tool called BruteForceAI has arrived, bringing automation and artificial intelligence to the art of login page detection and brute-force attacks. Designed for security professionals and researchers, BruteForceAI streamlines two critical stages of a login attack: finding login forms…
Disney to Pay $10 Million Over Children’s Data Privacy Violations
In a landmark settlement announced on September 2, 2025, The Walt Disney Company has agreed to pay a $10 million civil penalty to resolve allegations by the United States Department of Justice that its subsidiaries violated federal law by collecting…
Android Issues Security Update to Patch Actively Exploited 0-Day Flaws
Google has released a critical Android Security Bulletin for September 2025, addressing multiple high-severity vulnerabilities that are currently being actively exploited in the wild. The security patch level 2025-09-05 or later is required to protect Android devices from these serious threats. The security bulletin…
IIS WebDeploy RCE Vulnerability Gets Public PoC
A newly disclosed remote code execution (RCE) vulnerability in Microsoft’s IIS Web Deploy toolchain has captured industry attention after the release of a public proof-of-concept. Tracked as CVE-2025-53772, this flaw resides in the unsafe deserialization logic of the msdeployagentservice and…
Top 10 Best Identity and Access Management (IAM) Tools in 2025
The rise of hybrid workforces and multi-cloud environments has made Identity & Access Management (IAM) more critical than ever. In 2025, a robust IAM solution is the cornerstone of a Zero Trust security model, where no user, device, or application…
Stealthy Python Malware Uses Discord to Steal Windows Data
Inf0s3c Stealer, a stealthy Python-based grabber built to harvest system information and user data from Windows hosts. Packed as a 64-bit PE file compressed with UPX and bundled via PyInstaller, the executable imports a suite of Windows API functions to…
Hackers Use Hexstrike-AI to Exploit Zero-Day Flaws in Just 10 Minutes
Within hours of its release, the newly unveiled framework Hexstrike-AI has emerged as a game-changer for cybercriminals, enabling them to scan, exploit and persist inside targets in under ten minutes. Originally touted as a powerful red-team tool, Hexstrike-AI rapidly morphed into an…
Hijacked by RapperBot: Devices Exploited for Instant DDoS Attacks
A newly uncovered variant of the notorious RapperBot malware is covertly commandeering internet-connected devices—particularly outdated network video recorders (NVRs)—and transforming them into a powerful distributed denial-of-service (DDoS) army in mere moments. Security researchers have detailed a sophisticated exploit chain that…
Jaguar Land Rover Confirms Cyberattack Disrupting Global IT Systems
Jaguar Land Rover (JLR), the UK’s leading luxury automotive manufacturer, has disclosed that it is the victim of a significant cyberattack affecting its global information technology infrastructure. In a statement released early Wednesday, JLR confirmed that an unauthorized intrusion forced…