• Red Hat has disclosed a significant security flaw in OpenShift GitOps that could allow authenticated users to take complete control of a cluster. Assigned the identifier CVE-2025-13888, this vulnerability allows namespace administrators to elevate their privileges beyond their intended scope, potentially gaining root access to the entire system. Category Information CVE ID CVE-2025-13888 Vendor Severity Important […]

    The post OpenShift GitOps Vulnerability Allows Attackers to Escalate Privileges to Root appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • AI-assisted coding and AI app generation platforms have created an unprecedented surge in software development. Companies are now facing rapid growth in both the number of applications and the pace of change within those applications. Security and privacy teams are under significant pressure as the surface area they must cover is expanding quickly while their staffing levels remain largely

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The rapid global expansion of solar energy infrastructure has created an unprecedented cyber vulnerability. As millions of homes, businesses, and hospitals adopt renewable power sources supported by government initiatives like the U.S. Inflation Reduction Act and Europe’s Renewable Energy Directive. Security researchers have uncovered a critical flaw: many solar systems still rely on decades-old industrial […]

    The post Internet-Based Solar Panel Systems Vulnerable to Rapid Cyberattacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Fortinet’s FortiGate appliances face immediate threat from two critical authentication bypass vulnerabilities being actively exploited in production environments. Fortinet released advisories for CVE-2025-59718 and CVE-2025-59719 on December 9, 2025, identifying critical flaws in FortiCloud SSO authentication mechanisms. These vulnerabilities enable unauthenticated attackers to bypass SSO login protections through crafted SAML messages when FortiCloud SSO is […]

    The post Critical FortiGate SSO Vulnerability Actively Exploited in Real-World Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat actors have begun to exploit two newly disclosed security flaws in Fortinet FortiGate devices, less than a week after public disclosure. Cybersecurity company Arctic Wolf said it observed active intrusions involving malicious single sign-on (SSO) logins on FortiGate appliances on December 12, 2025. The attacks exploit two critical authentication bypasses (CVE-2025-59718 and CVE-2025-59719

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft has released comprehensive guidance on CVE-2025-55182, a critical pre-authentication remote code execution (RCE) vulnerability affecting React Server Components and the Next.js framework. Assigned a maximum CVSS score of 10.0, this vulnerability enables attackers to execute arbitrary code on vulnerable servers through a single malicious HTTP request, representing an unprecedented risk to modern React-based web […]

    The post Microsoft Outlines Mitigation for React2Shell RCE Vulnerability in React Server Components appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A novel WhatsApp account-takeover campaign dubbed “GhostPairing Attack” has emerged, enabling threat actors to gain complete access to victim accounts without stealing passwords or conducting SIM swaps. Security researchers at Gen have uncovered the sophisticated social engineering scheme that exploits WhatsApp’s legitimate device pairing feature to compromise accounts across multiple countries silently. The GhostPairing Attack […]

    The post GhostPairing Attack Exposes WhatsApp Accounts to Full Takeover via Phone Numbers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • US auto loan service 700Credit confirms a data breach exposed names, addresses, and Social Security numbers of dealership customers. Free credit monitoring is offered.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A new partnership between a European chipmaker and software firm aims to ease the difficult  task of creating defense systems with encryption strong enough to withstand attacks by tomorrow’s quantum computers.

    SEALSQ, which specializes in “quantum-safe” chips, and Airmod, a French company that specializes in secure electronics for aerospace and drones, say they can help companies produce the larger, more energy-intensive software that meets standards for quantum-safe hardware and software environments, as defined by the National Institute of Standards and Technology, or NIST. 

    Under a deal announced Monday, the partners will use Airmod’s middleware software to help clients turn “months of complex cryptographic integration into days” by allowing clients to bridge more easily apply software from previous applications into new ones. 

    The standards reflect growing concern and certainty among a broad range of computer and security professionals that engineers—most likely in either China or the United States—will announce the development of a quantum computer capable of breaking Shor’s algorithm before 2035. This is the encryption standard that runs at the heart of most of the world’s financial transactions, web surfing, and device-to-device communication (such as drone operation). Whoever wins the race would essentially have a backdoor into private transactions and communications all over the world.

    In 2022, China claimed it had already reached that threshold, much to the skepticism of many U.S. national security officials and quantum computing experts from around the world. But China is ahead of the United States in many areas of quantum sensing and computing research; it  has also been exfiltrating encrypted data that could be unlocked after a quantum breakthrough.

    The new standards mean that many companies will effectively phase out chips that exist in much common computer hardware, as well as the applications running on that hardware, replacing both with quantum-safe versions—at least, that’s the hope.

    “What does it mean to implement the new generation of algorithms? There is a certain urgency for [many businesses to] understand a bit better,” Gweltas Radenac, IoT security business director at SEALSQ, told Defense One in an exclusive interview.

    But he pointed out that computer and software applications today are so complex and interconnected that a company that believes it has done all it needs to do to meet new standards may still be vulnerable to side-channel attacks in addition to more direct remote attacks.

    A bigger challenge, which the partnership seeks to address, is that the new encryption protocols are much larger than the previous ones. This makes it harder to write applications for them, and the process of designing applications is more energy-intensive.

    That has particularly bad ramifications for the emerging defense startup industry focused on the delivery of new drones. Ukraine, the leader in this field, often has to rely on components that are easily procured in large numbers, including chips from China, and needs to design and deploy them quickly in the face of rapidly changing electronic warfare tactics.

    Jean-Marc Prichard, head of sales and marketing at Airmod, said the company is trying to address both the high costs of designing quantum-safe algorithms and the larger concern of China’s dominance in many types of chips. This includes many of the less sophisticated ones that are part of connected devices like drones. The company is also looking for ways to move production closer to customers, and can already do so for some production aspects, such as embedding customer-specific data on the chip at a location that meets stronger security requirements.

    “So if a U.S. customer wants to have his own data to be injected in the secure chip, we can offer a service where it's done on the U.S. footprint, for instance,” he said.

    The partnership news comes as Europe reinvests in its own chip foundries under its own version of a Chips Act, a 2023 effort to “strengthen the semiconductor ecosystem in the EU,” according to the European Commission. The effort accelerated in March, when nine EU members agreed to join the coalition. 

    Meanwhile NIST, the preeminent global standards body for computer security, shed key researchers in May and has faced budgetary hurdles even before Donald Trump’s administration took over. Since January, NIST researchers have worried that government cutbacks hurt travel and research budgets, which they worried could reduce U.S. influence in setting international standards.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The security vulnerability known as React2Shell is being exploited by threat actors to deliver malware families like KSwapDoor and ZnDoor, according to findings from Palo Alto Networks Unit 42 and NTT Security. “KSwapDoor is a professionally engineered remote access tool designed with stealth in mind,” Justin Moore, senior manager of threat intel research at Palo Alto Networks Unit 42, said in a

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶