GBHackers on Security | #1 Globally Trusted Cyber Security News Platform

HackSynth is an autonomous penetration testing agent that leverages Large Language Models (LLMs) to solve Capture The Flag (CTF) challenges without human intervention.  It utilizes a two-module architecture: a planner to create commands and a summarizer to understand the hacking process’s current state by employing contextual information from past commands to make future decisions and […]

The post HackSynth : Autonomous Pentesting Framework For Simulating Cyberattacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Fuji Electric Indonesia has fallen victim to a ransomware attack, impacting its operations and raising concerns about data security and business continuity. The attack was publicly disclosed by Fuji Electric’s headquarters on December 2, 2024, through an official notice, which highlighted the immediate steps taken by the company to address the situation and mitigate its […]

The post Fuji Electric Indonesia Hit by Ransomware Attack appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical vulnerability identified as CVE-2024–53614 has been discovered in the Thinkware Cloud APK version 4.3.46. This vulnerability arises from the use of a hardcoded decryption key within the application. It allows malicious actors to access sensitive data and execute arbitrary commands with elevated privileges, potentially compromising the security of users’ devices and data. The […]

The post Thinkware Cloud APK Vulnerability Allows Code Execution With Elevated Privileges appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

I-O DATA DEVICE, INC. has announced that several critical vulnerabilities in their UD-LT1 and UD-LT1/EX routers are being actively exploited. These vulnerabilities pose significant risks to users, necessitating urgent attention and action. Below is a detailed look at each vulnerability, its potential impact, and the solutions provided. CVE-2024-45841: Incorrect Permission Assignment for Critical Resource This […]

The post I-O DATA Routers Command Injection Vulnerabilities Actively Exploited in Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Researchers released a detailed report on a significant security vulnerability named CVE-2023-49785, affecting the ChatGPT Next Web, popularly known as NextChat. This vulnerability has raised concerns within the cybersecurity community due to its potential for exploitation through Server-Side Request Forgery (SSRF). NextChat is a web interface designed for large language model (LLM) services. It provides […]

The post ChatGPT Next Web Vulnerability Let Attackers Exploit Endpoint to Perform SSRF appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical vulnerability has been identified in the bootloader of Cisco NX-OS Software, potentially allowing attackers to bypass image signature verification. This flaw, which affects several Cisco product lines, could enable unauthorized users to load unverified software onto affected devices. The vulnerability is attributed to insecure bootloader settings within the Cisco NX-OS Software. Exploitation of […]

The post Cisco NX-OS Vulnerability Allows Attackers to Bypass Image Signature Verification appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Brain Cipher has claimed to have breached Deloitte UK and exfiltrated over 1 terabyte of sensitive data. Emerging in June 2024, Brain Cipher has quickly established a reputation for its aggressive cyberattacks, with a notable incident involving According to statements released by Brain Cipher, they have exploited critical weaknesses within Deloitte UK’s cybersecurity infrastructure. The […]

The post Deloitte Hacked – Brain Cipher Group Claim to Have Stolen 1 TB of Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cloudflare Pages, a popular web deployment platform, is exploited by threat actors to host phishing sites, as attackers leverage Cloudflare’s trusted infrastructure, global CDN, and free hosting to quickly set up and deploy convincing phishing sites.  Automatic SSL/TLS encryption enhances the sites’ legitimacy, while custom domains and URL masking further obfuscate their malicious nature. Cloudflare’s […]

The post Cloudflare Developer Domains Abused For Cyber Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Attackers are exploiting publicly exposed Docker Remote API servers to deploy Gafgyt malware by creating a Docker container using a legitimate “alpine” image to deploy the malware and infect the victim system with Gafgyt botnet malware.  It allows attackers to launch DDoS attacks on targeted servers, as this shift in the Gafgyt malware’s target range […]

The post Hackers Exploit Docker Remote API Servers To Inject Gafgyt Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Phishing attacks have surged nearly 40% in the year ending August 2024, with a significant portion of this increase linked to new generic top-level domains (gTLDs) like .shop, .top, and .xyz. These domains, known for their minimal registration requirements and low costs, have become attractive to cybercriminals, according to new research by Interisle Consulting. This […]

The post New TLDs Such as .shop, .top and .xyz Leveraged by Phishers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google has released a significant security update for its Chrome browser, aiming to address several vulnerabilities and enhance user safety. The Stable channel has been updated to version 131.0.6778.108/.109 for Windows, and Mac, and version 131.0.6778.108 for Linux. These updates will be gradually rolled out to users over the coming days and weeks. According to […]

The post Google Chrome Security Update, Patch for High-severity Vulnerability appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A registry overwrite remote code execution (RCE) vulnerability has been identified in NmAPI.exe, part of the WhatsUp Gold network monitoring software. This vulnerability, present in versions before 24.0.1, allows an unauthenticated remote attacker to execute arbitrary code on affected systems, posing significant security risks. Vulnerability Details The vulnerability lies within NmAPI.exe, a Windows Communication Foundation […]

The post Progress WhatsUp Gold RCE Vulnerability – PoC Exploit Released appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical vulnerability has been identified in the Mobile Security Framework (MobSF) that allows attackers to inject malicious scripts into the system. This vulnerability, CVE-2024-53999 is a Stored Cross-Site Scripting (XSS) flaw found in the “Diff or Compare” functionality, which occurs due to improper handling of file uploads with script-laden filenames. Details of the Vulnerability […]

The post MobSF XSS Vulnerability Let Attackers Inject Malicious Scripts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The National Security Agency (NSA) has partnered with the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and other entities to release a critical advisory. This initiative comes in response to the exploitation of major global telecommunications providers by a threat actor affiliated with the People’s Republic of China (PRC). The […]

The post CISA Releases Advisory to Monitor Networks to Detect Malicious Cyber Actors appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Federated Parameter-Efficient Fine-Tuning (FedPEFT) is a technique that combines parameter-efficient fine-tuning (PEFT) with federated learning (FL) to improve the efficiency and privacy of training large language models (PLMs) on specific tasks.  However, this approach introduces a new security risk called “PEFT-as-an-Attack” (PaaA), where malicious actors can exploit PEFT to bypass the safety alignment of PLMs […]

The post PEFT-As-An-Attack, Jailbreaking Language Models For Malicious Prompts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cybercriminals are leveraging AI-powered phishing attacks, website cloning tools, and RCE exploits to target e-commerce platforms during the holiday season, which allow attackers to craft convincing phishing emails, replicate legitimate websites, and gain unauthorized access to systems.  The objective of cybercriminals is to steal sensitive information and financial data from shoppers who are unaware of […]

The post Hackers Cloning Websites, Exploiting RCE Flaws To Gain Access To Shopping Platforms appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

wevtutil.exe, a Windows Event Log management tool, can be abused for LOLBAS attacks. By manipulating its capabilities, attackers can execute arbitrary commands, download malicious payloads, and establish persistence, all while evading traditional security measures. It is a Windows tool for event log management that can be exploited by attackers to manipulate system logs, potentially concealing […]

The post Hackers Exploited Windows Event Logs Tool log Manipulation, And Data Exfiltration appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Reports have emerged of a potential data breach involving EazyDiner, a leading restaurant reservation platform. Alleged by a tweet from DailyDarkWeb, the breach is said to have compromised sensitive user data, including names, email addresses, phone numbers, and reservation details. This incident has raised significant alarm over the security and privacy measures in place to […]

The post Threat Actors Allegedly Claims Breach of EazyDiner Reservation Platform appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical vulnerability has been discovered in Salesforce applications that could potentially allow a full account takeover. The vulnerability, uncovered during a penetration testing exercise, hinges on misconfigurations within Salesforce Communities, particularly exploiting the Salesforce Lightning component framework. The implications of this vulnerability are severe, affecting both data security and privacy. Attackers could gain access […]

The post Salesforce Applications Vulnerability Could Allow Full Account Takeover appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A significant vulnerability has been identified in TP-Link’s HomeShield function, affecting a range of their devices, including the Archer, Deco, and Tapo series routers. This vulnerability, labeled CVE-2024-53375, allows attackers to exploit a flaw in the device firmware, leading to the potential injection of malicious commands by unauthorized users. This article explores the details of […]

The post TP-Link HomeShield Function Vulnerability Let Attackers Inject Malicious Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.