New DRAM Scrambling Attack Unlocks AMD CPU PSP, SMM and Microcode
Security researcher Christopher Domas has released a proof-of-concept project called “skitter-creek-bath-salts,” which demonstrates a vulnerability in AMD’s ...
GBHackers
20 articles
Apple Warns iPhone Users in 110 Countries of Mercenary Spyware Attacks
Apple has issued a new set of high-confidence Apple Threat Notification alerts, warning selected iPhone users in 110 countries that they may be targets of go...
PATCHCORD Infrastructure Hosts SuperShell C2 for Remote Commands and Webshell Management
A newly uncovered espionage operation targeting Afghan telecom providers and South Asian critical infrastructure has exposed a layered attacker ecosystem bui...
Hackers Steal One AI Key, Resell the Compute, and Leave Victims With a Million-Dollar Bill
A rapidly expanding financial cybercrime model called AI token jacking, where threat actors steal developer API keys for popular AI platforms, consume the vi...
Fortinet FortiWeb and FortiClient Flaws Let Unauthenticated Attackers Gain Access and Execute Arbitrary Code
Fortinet has released security updates to address high-severity vulnerabilities in FortiWeb and FortiClient for Windows. These vulnerabilities could allow un...
Aeternum Hides Malware Commands on Polygon Blockchain Where Server Takedowns Can’t Erase Them
A newly analyzed malware operation called Aeternum is turning the public Polygon blockchain into a command-and-control (C2) channel, allowing attackers to di...
Trezor Shipping Provider Data Breach Exposes Personal Data of 13,689 Customers
Hardware wallet manufacturer Trezor has recently disclosed a data breach at ShipMonk, a third-party shipping provider. This breach exposed the personal infor...
Beacon CRM Data Breach Exposes Customer Data via Compromised AWS Access Key
Beacon CRM has confirmed that a threat actor likely downloaded a complete copy of its customer database after gaining access to its Amazon Web Services (AWS)...
New AmnesiaStealer Malware Targets macOS Users via ClickFix Attacks
A newly identified macOS infostealer, named AmnesiaStealer, targets users via ClickFix social-engineering campaigns that impersonate GitHub download pages. T...
Jewelbug Uses Public Google Docs as Malware Command-and-Control Delivery Channel
A China-linked threat group tracked as Jewelbug has turned public Google Docs into a resilient command-and-control delivery channel, embedding freshly obfusc...
Microsoft Exchange Server Vulnerabilities Allow DoS, Privilege Escalation, and RCE
Microsoft has released security updates that address six vulnerabilities in Exchange Server. These vulnerabilities include flaws that could allow remote code...
Critical Dell VMware vSphere Client Flaw Lets Remote Attackers Execute Commands as Root
Dell has disclosed a significant security vulnerability in its Virtual Storage Integrator (VSI) for VMware vSphere Client. This vulnerability could allow una...
Trump Administration Authorizes Cyber Operations Against Foreign Criminal Networks
The Trump administration has issued a presidential memorandum that establishes a federal program allowing vetted U.S.
LiteLLM Hack Exposes Secrets From 2,488 Companies Across 118,829 CI Runner Dumps
The LiteLLM supply-chain compromise has shifted from a short-lived malicious package incident into a sprawling enterprise exposure event. Analysis of an alle...
CISA Adds Actively Exploited Windows WinSock Vulnerability to KEV Catalog
The U.S.
Wireshark 4.6.8 Released to Patch 28 Security Vulnerabilities
Wireshark has released version 4.6.
Armored Likho Turns Windows Microphones Into Automated Eavesdropping Devices
Armored Likho, also tracked as Eagle Werewolf, has expanded its espionage capability with a Rust-based toolkit that can hijack Telegram sessions and transfor...
Cloudflare Mitigates 23.2 Million DDoS Attacks as 1 Tbps Attacks Surge 519%
Cloudflare has mitigated 23.2 million network-layer DDoS attacks and stopped 29.
6,330 Internet-Exposed ICS Devices Near U.S. Data Centers Put Cooling and Power Systems at Risk
A newly published internet-exposure analysis has identified more than 6,300 high-confidence industrial control system and building automation devices accessi...
Critical Adobe Commerce Flaw Lets Unauthenticated Attackers Escalate Privileges
Adobe has released security updates for Adobe Commerce, Adobe Commerce B2B, and Magento Open Source to address multiple critical vulnerabilities. One of the ...