WordPress has patched a high-severity vulnerability, tracked as CVE-2026-64638 and nicknamed XSS2Shell, that begins as an unauthenticated cross-site scripting bug on the login screen and can be chained into full remote code execution. Researchers at pwn.ai discovered the flaw, which carries a CVSS score of 8.9 and affects every actively maintained WordPress branch, a codebase […]

The post WordPress XSS2Shell Flaw Enables Attackers to Achieve Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

SCTPhantom, tracked as CVE-2026-64564, is a high-severity Linux kernel use-after-free vulnerability in the Stream Control Transmission Protocol (SCTP) Dynamic Address Reconfiguration implementation. Researchers at Tencent Zhuque Lab’s Corvus AI project reported that a local attacker could leverage the flaw to escalate privileges to root and, in certain configurations, to escape from containers to the host. […]

The post 18-Year-Old Linux Kernel SCTP Vulnerability Lets Attackers Gain Root and Escape Containers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A cross-platform malware campaign that disguises itself as a legitimate Zoom installer to deploy Overlord, an open-source remote access trojan (RAT), on both macOS and Windows machines. Documented by Jamf, unlike most macOS malware, which typically relies on Go or Rust for cross-platform reach, this campaign’s first-stage downloader, a macOS ARM64 Mach-O binary named ZoomMeetings, […]

The post Fake Zoom Installer Uses .NET Downloader to Deploy Overlord RAT on macOS appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Apple has shipped emergency macOS updates to close a critical vulnerability in Screen Sharing, tracked as CVE-2026-65400, which allows unauthenticated remote attackers to execute arbitrary code and access files with root-level privileges. The flaw is especially severe on systems where Screen Sharing is exposed to the public internet. Apple’s August 6 releases macOS Tahoe 26.6.1, […]

The post Critical macOS RCE Vulnerability Allows Attackers to Gain Root Access Without Password appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A large-scale supply chain attack has hit the npm registry, with a suspected Russian threat actor publishing more than 700 malicious packages in just 48 hours. Researcher Paul McCarty documented the campaign, tracked as WEL1DROPPER, and the package count has since grown past 1,000. WEL1DROPPER marks an evolution in AI slopsquatting, where attackers register randomly […]

The post Russian Hackers Use AI Slopsquatting to Publish 700+ Malicious npm Packages appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.