GBHackers on Security | #1 Globally Trusted Cyber Security News Platform

More than 20,000 malicious Cloudflare Pages subdomains used by Help TDS, a longstanding traffic distribution system that funnels victims into fraudulent technical support call centers. Researchers assess with high confidence that Hotejka, a Russian-language affiliate program, operates Help TDS and represents a rebrand of ROI777. Historical DNS records, shared infrastructure, persistent affiliate identifiers, and consistent […]

The post Researchers Uncover 20,000 Malicious Cloudflare Pages Domains Used in Tech Support Scams appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A suspected China-nexus espionage group exploited a critical zero-day in BeyondTrust Remote Support, tracked as CVE-2026-102764. It then deleted logs to hide its activity. BeyondTrust patched the flaw in advisory BT26-05 and disclosed it on October 15, 2026, alongside a Mandiant analysis. BeyondTrust zero-day According to research published by BeyondTrust, the actor exploited the vulnerability […]

The post Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical unauthenticated OS command injection flaw in Collabora Online’s built-in CODE Server app for Nextcloud lets remote attackers run commands as the web server user. The advisory rates it 9.2 on CVSS v4. Collabora Online vulnerability According to the security advisory published by Collabora Online on GitHub, the vulnerability is tracked as CVE-2026-110447 and […]

The post Critical Collabora Online Flaw Lets Attackers Execute Commands on Nextcloud Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Microsoft and international partners have disrupted infrastructure supporting CoGUI. This phishing kit Proofpoint says generates more than 100 million malicious emails monthly. The coordinated action targeted a Chinese-speaking fraud ecosystem encompassing related phishing kits, infrastructure providers, and services enabling credential theft and financial fraud. Microsoft and Health-ISAC filed a civil lawsuit in the U.S. District […]

The post Microsoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Researchers at pwn.ai used an AI-assisted research harness to find a critical Linux kernel networking flaw, tracked as CVE-2026-99999 and nicknamed “PwnEscape”. It lets an untrusted guest virtual machine leak host kernel memory and, in lab conditions, escape to the host. The bug is in the Linux networking stack, not in KVM or any hypervisor. […]

The post Researchers Use AI to Discover Critical Linux Kernel Flaw That Enables Virtual Machine Escape appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

NowSecure and Data Theorem mobile security lead automated mobile testing, Guardsquare owns shielding/obfuscation, and Corellium’s virtual devices changed what deep mobile research costs. Twelve options across testing, shielding, virtualization, and runtime lanes mapped to MASVS so the acronyms mean something. Quick Verdict: Best Mobile AppSec at a Glance • Best automated testing: NowSecure (pipeline MAST) […]

The post 12 Best Mobile Application Security Testing Tools Compared (2026): Features & Pricing appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Anchore’s Syft SBOM generator is the free generation standard, FOSSA and Cybeats lead SBOM management, and Finite State owns the embedded/OT depth regulators now demand. Twelve options across generation, management, and monitoring lanes with CycloneDX honestly framed as the OWASP standard powering much of it rather than a vendor to shortlist. Quick Verdict: Best SBOM […]

The post 12 Best SBOM Tools Compared (2026): Features & Pricing appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Your CI platform’s native controls (GitHub Advanced Security, GitLab Ultimate) are the baseline, Cycode and Legit lead dedicated pipeline posture, and StepSecurity owns the runner-hardening niche attackers actually exploit. Twelve options across native, dedicated, hardening, and platform-absorbed lanes because the factory is now the target. Quick Verdict: Best CI/CD Security at a Glance • Native […]

The post 12 Best CI/CD Pipeline Security Tools Compared (2026): Features & Pricing appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The Aoki infostealer, also known as Aokigahara, has expanded its collection capabilities to steal credentials and session files from AI coding assistants, putting developer identities and connected infrastructure at risk. First observed earlier in 2026, Aoki previously lacked collection routines for AI applications. Their appearance in recent samples indicates active development, with attackers broadening their […]

The post Hackers Target Claude, ChatGPT and Cursor Credentials Using Aoki Infostealer appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A newly disclosed proxyjacking campaign has compromised at least 143 devices across 34 countries, exploiting vulnerabilities in network appliances and enterprise software to monetize victims’ internet connections. GreyNoise identified an attacker installing Pawns.app, a legitimate bandwidth-sharing application, without device owners’ consent, turning compromised systems into commercial residential proxy nodes. Unlike conventional VPN or hosting infrastructure, […]

The post New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability as a zero-day in late August 2026 weeks before BeyondTrust disclosed it on October 15. Mandiant, which investigated the incident, found the attackers used the flaw to upload a file, then built a path from an unprivileged web service account to root access, […]

The post Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cisco has warned that attackers are actively exploiting a zero-day flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. An unauthenticated remote attacker can use it to write arbitrary files and run commands as root on the underlying operating system. The advisory, cisco-sa-esa-afw-zqYJkjxp, says Cisco PSIRT learned of active exploitation in […]

The post Cisco Warns of Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Palo Alto Networks has warned that attackers are exploiting a high-severity remote code execution flaw in the PAN-OS management interface. Tracked as CVE-2026-0322, the bug lets an authenticated attacker with network access run arbitrary code with root privileges on the firewall. PAN-OS zero-day vulnerability The flaw is a code injection weakness (CWE-94, CAPEC-242) in the […]

The post Palo Alto Warns of PAN-OS 0-day Flaw Actively Exploited in Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Citizen Lab has confirmed the first public case of zero-click mercenary spyware delivered through targeted online ads. It calls the technique “AdFection”. The attack hit devices at Al Jazeera with Candiru spyware, and the ads were bought by an Israeli ad-tech firm called Discover-Tech. zero-click spyware attacks Online ads are sold in real-time auctions that […]

The post Hackers Use Online Ads to Infect Devices With Spyware Without a Single Click appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

PEERSTITCH, a memory-resident ARM64 implant deployed against FortiGate firewalls during a prolonged intrusion into a telecommunications managed service provider. The malware hijacks legitimate FortiOS processes, leaving no persistent executable, opening no listening ports, and initiating no outbound connections of its own. Published October 14, the investigation tracks the activity as CL-STA-0954, also known as UNC5820. […]

The post New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The UK’s Legal Aid Agency (LAA) now says the 2025 data breach exposed far older data than first reported. About 250,000 stolen records predate 2007, and the earliest verified record is from 1978. UK legal aid cyberattack The LAA identified a cyber-attack on its online digital services on Wednesday 23 April 2025. It secured its […]

The post Hackers Steal UK Legal Aid Records Dating Back to 1978 in Major Cyberattack appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A ClickFix campaign uses the Lorem Ipsum Loader to install a Python-based tunneling implant, giving attackers a covert route into victims’ networks and potentially laying the groundwork for ransomware deployment. In an incident investigated in late September, defenders contained the intrusion before ransomware was deployed; the tunnel’s remote-access capability nevertheless made the compromised host a […]

The post New ClickFix Attack Deploys Lorem Ipsum Malware Loader to Establish Remote Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Linus Torvalds used Anthropic’s Claude Code to build experimental patches that remove a long-running page-cache scalability bottleneck in the Linux kernel. The series is not merged. Reviewers have already found a race condition and raised memory-reclamation concerns. Torvalds pushed a branch named noref-filemap-read-with-llm to his own repository. Phoronix spotted it while the kernel awaited the […]

The post Claude Code Helps Linux Creator Address Longstanding Kernel Memory Performance Bottleneck appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

AI agents can expose credentials during routine development tasks, moving secrets from protected stores into command arguments, logs, transcripts, and inputs to external models. The concern is not that developer tools are inherently malicious. Rather, agents inherit developer privileges and repeatedly translate requests into shell commands, consuming their output before deciding what to execute next. […]

The post AI Agent Workflows Could Expose Credentials Through Trusted Developer Tools appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Vercel has released an out-of-band security update for Next.js that fixes two critical remote code execution (RCE) flaws and one high-severity denial-of-service (DoS) bug. One of the critical flaws, CVE-2026-96889 (GHSA-2464-fhr4-w9xw), sits in the Image Optimization API and is triggered through SVG processing. Next.js SVG vulnerability According to security disclosures published by Vercel, the update […]

The post Critical Next.js SVG Image Processing Vulnerability Could Enable Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.