1010.cx – Page 11 – cybersecurity / defense / intelligence

BlackTech APT Uses New BlueShell Linux Backdoor in Attacks on Japanese Organizations

·

APT, cyber security, Cyber Security News, Linux

BlackTech, a long-running China-aligned APT group, has adopted a new Linux backdoor built on the BlueShell open-source RAT to conduct post-intrusion operations against Japanese organizations, signaling ongoing toolchain evolution and focused targeting of enterprise Linux environments. Originally published on GitHub with Chinese-language documentation, BlueShell has seen limited but consistent abuse by China-based threat actors, including […]

The post BlackTech APT Uses New BlueShell Linux Backdoor in Attacks on Japanese Organizations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Critical Adobe Campaign Flaw Lets Attackers Execute Arbitrary Code

·

CVE/vulnerability, cyber security, Cyber Security News, vulnerability

Adobe has released a critical security update for Adobe Campaign Classic to address multiple high-severity vulnerabilities that could allow attackers to execute arbitrary code and access sensitive data through unauthorized file system reads. This advisory, tracked as APSB26-114 and published on July 29, 2026, has a priority rating of 1, indicating the highest level of […]

The post Critical Adobe Campaign Flaw Lets Attackers Execute Arbitrary Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Critical SolarWinds Web Help Desk Flaw Lets Attackers Bypass SAML Authentication

·

CVE/vulnerability, cyber security, Cyber Security News, Vulnerabilities, vulnerability

SolarWinds has released Web Help Desk (WHD) version 2026.2.1 to address a critical authentication bypass vulnerability. This flaw could allow attackers to gain unauthorized access to affected systems by exploiting weaknesses in SAML-based single sign-on (SSO) implementations. Tracked as CVE-2026-28323 and assigned a CVSS score of 9.8, the vulnerability impacts deployments where SAML 2.0 authentication […]

The post Critical SolarWinds Web Help Desk Flaw Lets Attackers Bypass SAML Authentication appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Recon-Only SSH Attack Leaves No Malware but Signals a Second-Stage Intrusion

·

cyber security, Cyber Security News

Recon-only activity on SSH is not harmless background noise. A recent honeypot session shows an automated Go-based bot logging in as root, exhaustively grading host hardware for cryptomining suitability, then exiting without dropping a single binary. Cowrie, which exposes a realistic fake Linux shell and records full command transcripts, logged a connection from 91.92.40.13 that […]

The post Recon-Only SSH Attack Leaves No Malware but Signals a Second-Stage Intrusion appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
PHP Patches 3 Security Flaws Enabling SQL Injection, Memory Corruption and DoS Attacks

·

CVE/vulnerability, cyber security, Cyber Security News, PHP, Vulnerabilities, vulnerability

PHP maintainers have released security updates to address three vulnerabilities affecting the PostgreSQL, BCMath, and Phar extensions. These vulnerabilities could potentially lead to SQL injection attacks, out-of-bounds memory writes, and denial-of-service attacks in vulnerable applications. The issues impact several actively maintained PHP release branches and have been resolved in versions PHP 8.2.338.2, 8.3.338.3, 8.4.248.4, and […]

The post PHP Patches 3 Security Flaws Enabling SQL Injection, Memory Corruption and DoS Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Chinese-Speaking Hacker Uses DeepSeek Agent to Launch Autonomous Cyberattacks

·

Cyber Attack, cyber security, Cyber Security News, DeepSeek

Chinese-speaking threat actor “knaithe” (aka KnYuan) has been caught running an AI-enabled autonomous attack stack built around DeepSeek and the Hermes Agent framework, proving that large language models can now drive end‑to‑end offensive operations with minimal human oversight. Hermes provided terminal access, skills orchestration, and Model Context Protocol (MCP) integrations. At the same time, DeepSeek […]

The post Chinese-Speaking Hacker Uses DeepSeek Agent to Launch Autonomous Cyberattacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations

·

Anthropic on Thursday became the latest artificial intelligence (AI) company to reveal that three of its models, including Claude Opus 4.7, Mythos 5, and an unnamed research model, had breached three unnamed organizations during cybersecurity testing without its knowledge. The AI firm said the earliest incidents date back to April 2026, adding it made the discoveries after launching a “

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
ShutterGap Exposes Millions of Misconfigured AWS Resources to Attackers

·

Amazon AWS, AWS, cyber security, Cyber Security News

A cloud-security blind spot known as Cloud ShutterGap, which involves millions of AWS resources being briefly exposed to the public before being removed, often within minutes. These short-lived misconfigurations can include Amazon RDS and DocumentDB snapshots, Amazon Machine Images (AMIs), and AWS Systems Manager (SSM) documents that contain sensitive organizational data. ShutterGap Exposes Millions of […]

The post ShutterGap Exposes Millions of Misconfigured AWS Resources to Attackers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Astaroth Banking Trojan Adds WhatsApp Web Spambot to Spread Malware Across Brazil

·

cyber security, Cyber Security News, Malware, WhatsApp

Astaroth operators have expanded their Brazilian banking malware operations by weaponizing a new WhatsApp Web spambot module that turns infected hosts into automated malware relays, marking a significant evolution of the LATAM e-crime ecosystem. Traditionally propagated via email and archive-based phishing, recent campaigns such as STAC3150 and the “Boto Cor-de-Rosa” operation shifted distribution to WhatsApp […]

The post Astaroth Banking Trojan Adds WhatsApp Web Spambot to Spread Malware Across Brazil appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
CISA Urges Water Utilities to Remove Publicly Exposed PLCs From the Internet

·

cyber security, Cyber Security News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert to the Water and Wastewater Systems (WWS) Sector due to a significant rise in cyber threat activity targeting internet-exposed programmable logic controllers (PLCs). Released on July 30, 2026, the advisory urges critical infrastructure owners, operators, and system integrators to immediately identify and […]

The post CISA Urges Water Utilities to Remove Publicly Exposed PLCs From the Internet appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶