NIST Issues New Guidance to Protect SSO and API Tokens From Theft and Forgery
The National Institute of Standards and Technology (NIST) has published new implementation guidance to safeguard identity tokens, access tokens, and assertio...
GBHackers
20 articles
12 Best CIEM Tools Compared (2026): Features & Pricing
Quick Answer: CIEM bills per identity or per cloud resource, and the count that matters is non-human identities machines outnumber people many-fold and infla...
12 Best CASB Solutions Compared (2026): Features & Pricing
Quick Answer: Nobody buys standalone CASB anymore you buy an SSE seat and CASB rides along. That flips the cost question: Defender for Cloud Apps is already ...
Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results
Iranian state-linked cyber actors are using fake AI applications, antivirus tools and even fabricated MRI scan results to deliver CHOSEN BRICK, a Windows-foc...
CISA Warns Hackers Exploit 17 Active Directory Techniques to Gain Control of Enterprise Networks
The U.S.
Apple Releases iOS 27 Security Update to Fix Over 120 Vulnerabilities
Apple has released iOS 27 and iPadOS 27, delivering one of its largest mobile security update batches to date. The release addresses approximately 126 vulner...
KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions
A Brazilian banking malware operation, dubbed KREMLIN, that can silently implant malicious extensions in Google Chrome and Microsoft Edge, bypassing Chromium...
Luciferus Uncensored AI Service Lets Cybercriminals Generate RAT Malware
Cybercriminals are promoting a new “uncensored” artificial intelligence service called Luciferus that allegedly generates malicious code, including component...
OpenAI Agent Swarm Linked to 3,022 Malicious RubyGems Packages in GemStuffer Campaign
3,022 RubyGems packages associated with the GemStuffer campaign, expanding the known scope of an incident that researchers have linked to an alleged OpenAI a...
Google Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google has released Chrome version 153 to the Stable channel for desktop, addressing 42 security vulnerabilities, including three critical-severity flaws aff...
Google Search Makes It Harder to See Where a Link Really Goes Before You Click
Google has begun routing some organic Search result links through opaque google.com/goto?
Phishing Attacks Abuse Trusted Email Infrastructure and URL Cloaking to Evade Security Filters
Phishing operators are increasingly shifting away from malware-laden attachments and toward trusted delivery services, authenticated domains, and multi-stage...
Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors
Threat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin that lets unauthenticated attackers upload ma...
Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week
Microsoft Patches 973 CVEs, Claude Agents Automate Attacks, China Chains Chrome Zero-Day, Cisco FMC Exploited & More. Welcome to this week’s edition of the G...
WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites
Two critical unauthenticated vulnerability chains in the widely used The Events Calendar WordPress plugin could allow attackers to execute code and fully com...
Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit
A Chinese-speaking threat actor known as Red Heron has exploited a critical remote code execution (RCE) vulnerability in Gitea to steal private source code, ...
Telegram Desktop XSS Vulnerability Lets Attackers Steal Entire Chat Histories
A stored cross-site scripting (XSS) vulnerability in Telegram Desktop could enable attackers to steal the contents of exported chat histories by embedding ma...
Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
A threat actor exploited a critical pre-authentication remote code execution vulnerability in marimo to harvest AWS credentials, retrieve an SSH private key ...
DDRop Attack Forces Intel TDX Confidential VMs Into Debug Mode and Exposes Memory
A newly disclosed hardware attack dubbed DDRop can undermine Intel Trust Domain Extensions (TDX) by manipulating DDR5 memory traffic, allowing an attacker wi...
Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges
Security researchers have disclosed a local privilege escalation vulnerability in the Linux kernel related to the Reliable Datagram Sockets (RDS) zero-copy s...