• Microsoft has launched a new security feature in Teams Premium called “Prevent screen capture,” designed to block screenshots and recordings during sensitive meetings, with general availability rolling out worldwide through late November 2025.​

    This enhancement addresses growing concerns over data leaks in virtual collaborations, particularly in industries like finance, healthcare, and legal sectors, where confidential information is routinely shared.

    Previously announced in the Microsoft 365 Roadmap under ID 490561, the feature’s timeline was updated on November 12, 2025, shifting the general availability start from mid-October to early November to allow for additional testing and refinements.

    Targeted release began in mid-September 2025 for select users, but broader deployment is now underway, ensuring organizations can protect meeting content from unauthorized captures using native tools and most third-party apps.​

    How the Feature Works

    When enabled, “Prevent screen capture” restricts visual access to meeting elements like the stage view, chat, participant lists, and Copilot panels.

    On Windows desktops, attempts to screenshot result in a black rectangle obscuring the meeting window, including any pop-out sections, preventing clear captures of shared screens or documents.

    Android devices, including phones and tablets, fully block screenshots and recordings, displaying a notification to users that screen capture is restricted.​

    Unsupported platforms, such as iOS, macOS, web browsers, or non-Intune-enrolled devices, force participants into audio-only mode, limiting them to voice without video or shared content visibility.

    This ensures confidentiality but may disrupt the experiences of some attendees, highlighting the need for device compatibility checks before meetings.​

    Organizers and co-organizers activate the feature via the Meeting Options menu under Advanced Protection, where a simple toggle switches it on or off by default to avoid unintended restrictions.

    As shown in Microsoft’s preview of the settings interface, the option appears alongside other protections, such as content-forwarding blocks and end-to-end encryption toggles.​

    Teams interface
    Teams interface

    For IT admins and security teams, this tool integrates with Entra ID for licensing management and device enrollment via Intune, enabling scalable enforcement.

    However, it raises compliance concerns under regulations such as the GDPR, as it limits users’ ability to capture or retain personal data shared in meetings, potentially affecting data subjects’ rights to access and export it.​

    Organizations should prepare by educating organizers on the feature’s use, updating internal policies for Teams Premium, and verifying mobile device compliance.

    While effective against digital captures, experts note it doesn’t prevent physical photos of screens, underscoring layered security approaches.​

    This rollout underscores Microsoft’s push toward fortified collaboration tools amid rising cyber threats, offering a practical shield for high-stakes discussions without overcomplicating everyday use.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft Teams New Premium Feature Blocks Screenshots and Recordings During Meeting appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • On Friday, November 7th, Veracode Threat Research discovered a dangerous typosquatting campaign targeting developers using GitHub Actions. The malicious npm package “@acitons/artifact” had accumulated over 206,000 downloads before being removed, posing a significant threat to GitHub-owned repositories and potentially compromising sensitive authentication tokens. The malicious package mimicked the legitimate “@actions/artifact” npm package, which is part […]

    The post Malicious npm Package with 206K Downloads Targeting GitHub Repositories to Steal Tokens appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The SmartApeSG campaign, also known as ZPHP and HANEYMANEY, continues to evolve its infection tactics, pivoting to ClickFix-style attack vectors. Security researchers have documented the campaign’s latest methodology, which uses deceptive fake CAPTCHA pages to trick users into executing malicious commands that ultimately deploy NetSupport RAT a Remote Access Trojan capable of giving attackers complete […]

    The post SmartApeSG Uses ClickFix to Deploy NetSupport RAT appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The notorious Cl0p ransomware group has claimed responsibility for breaching the UK’s National Health Service (NHS), spotlighting vulnerabilities in Oracle’s E-Business Suite (EBS).

    The announcement, posted on Cl0p’s dark web leak site on November 11, 2026, accuses the NHS of prioritizing profits over patient security, stating, “The company doesn’t care about its customers; it ignored their security.”

    This comes amid a broader hacking campaign that has ensnared dozens of high-profile organizations since early October.

    The NHS, which serves over 1.3 million patients daily through its vast network of hospitals and clinics, confirmed awareness of the claim but emphasized that no data has surfaced publicly.

    “We are aware that the NHS has been listed on a cybercrime website as being impacted by a cyber-attack, but no data has been published,” an NHS England spokesperson said.

    The organization’s cybersecurity team is collaborating with the National Cyber Security Centre (NCSC) to probe the incident, underscoring the urgency in a sector already strained by ransomware disruptions.

    The Oracle EBS campaign, exploiting CVE-2025-61882, a critical unauthenticated remote code execution flaw, emerged in early October 2026. Within weeks, attackers began doxxing victims on Cl0p’s site.

    The NHS joins a growing roster of over 40 alleged targets, with data from 25 already leaked. Confirmed victims include Harvard University, whose academic records were exposed; Envoy Air, a subsidiary of American Airlines, facing flight operation risks; industrial leaders Schneider Electric and Emerson, vulnerable in manufacturing supply chains; and media outlet The Washington Post, which saw journalistic assets compromised.

    Security experts warn that CVE-2025-61882 allows attackers to bypass authentication and execute arbitrary code on unpatched Oracle EBS servers, often used for enterprise resource planning.

    Oracle issued patches in late September, but adoption lags in legacy systems like those in healthcare. “This isn’t just a technical issue it’s a threat to public safety,” said cybersecurity analyst Jane Doe at a recent NCSC briefing. “Ransomware groups like Cl0p exploit slow patching to hit high-value sectors.”

    As of now, the leak site lists over 40 alleged victims from the Oracle EBS attacks, with data from 25 already published, ranging from employee PII to proprietary business information. For the NHS, the stakes are particularly high.

    Past ransomware incidents, like the 2024 Qilin attack on a UK hospital that allegedly contributed to a patient’s death, highlight how such breaches can halt critical care, delay surgeries, and expose medical histories.

    Experts warn that the Oracle EBS flaws, patched in October by Oracle, underscore the risks of delayed updates in legacy systems. “Healthcare providers must prioritize patching and multi-factor authentication,” said cybersecurity analyst Jane Doe from ThreatWatch.

    The NHS investigation continues, with no confirmation of data exfiltration yet, but the incident serves as a stark reminder of ransomware’s growing menace to public services.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post NHS Investigating Oracle EBS Hack Following Cl0p Ransomware Group Claim appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated campaign attributed to North Korean-aligned threat actors is weaponizing legitimate JSON storage services as an effective vector for deploying advanced malware to software developers worldwide. The “Contagious Interview” operation demonstrates how threat actors continue to innovate in their abuse of trusted infrastructure to evade security controls and establish persistent system access. The Contagious […]

    The post Threat Actors Use JSON Storage for Hosting and Delivering Malware via Trojanized Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security researcher Paul McCarty has uncovered a massive coordinated spam campaign targeting the npm ecosystem. The IndonesianFoods worm, comprising over 43,000 malicious packages published across at least 11 user accounts, remained active in the registry for nearly two years before detection. The campaign derives its distinctive name from its unique package naming scheme. The embedded […]

    The post Hackers Infiltrate npm Registry with 43,000 Spam Packages, Linger for Nearly Two Years appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security researchers have successfully extracted the system prompt from OpenAI’s Sora 2 video generation model by exploiting cross-modal vulnerabilities, with audio transcription proving to be the most effective extraction method. Sora 2, OpenAI’s state-of-the-art multimodal model for generating short video content, was thought to keep its system prompt secure. However, researchers discovered that by chaining […]

    The post OpenAI Sora 2 Vulnerability Allows Exposure of Hidden System Prompts from Audio Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • GitLab has released urgent security patches addressing multiple vulnerabilities affecting both the Community Edition and the Enterprise Edition.

    The company released versions 18.5.2, 18.4.4, and 18.3.6 to fix critical security issues that could allow attackers to compromise sensitive information and bypass access controls.

    The most concerning vulnerability involves prompt injection attacks in GitLab Duo’s review feature. Attackers can inject hidden malicious prompts directly into merge request comments.

    These hidden instructions trick the AI system into leaking sensitive information from confidential issues. This vulnerability affects GitLab Enterprise Edition versions 17.9 and later, potentially exposing classified project data to unauthorized users.

    Beyond prompt injection, GitLab patched nine additional vulnerabilities ranging from high to low severity.

    CVE IDVulnerability TitleTypeSeverityCVSS Score
    CVE-2025-11224Cross-site scripting issue in k8s proxyXSSHigh7.7
    CVE-2025-11865Incorrect Authorization issue in workflowsAuthorization BypassMedium6.5
    CVE-2025-2615Information Disclosure issue in GraphQL subscriptionsInformation DisclosureMedium4.3
    CVE-2025-7000Information Disclosure issue in access controlInformation DisclosureMedium4.3
    CVE-2025-6945Prompt Injection issue in GitLab Duo reviewPrompt InjectionLow3.5
    CVE-2025-6171Information Disclosure issue in packages API endpointInformation DisclosureLow3.1
    CVE-2025-11990Client Side Path Traversal issue in branch namesPath TraversalLow3.1
    CVE-2025-7736Improper Access Control issue in GitLab PagesAccess ControlLow3.1
    CVE-2025-12983Denial of service issue in markdownDenial of ServiceLow3.1

    cross-site scripting (XSS) vulnerability in the Kubernetes proxy allows authenticated users to execute malicious scripts, affecting versions 15.10 and later.

    An authorization bypass in workflows lets users remove AI flows belonging to other users, compromising workflow integrity. Information disclosure vulnerabilities also pose serious risks.

    Attackers can access sensitive data through multiple vectors: blocked users establishing GraphQL subscriptions, unauthorized viewing of branch names through access control weaknesses, and information leakage via the packages API endpoint, even when repository access is disabled.

    Additional vulnerabilities include path-traversal issues affecting branch names, improper access control in GitLab Pages that allows OAuth authentication bypasses, and denial-of-service attacks via specially crafted Markdown content.

    GitLab strongly recommends upgrading to the patched versions immediately. The company has already updated GitLab.com, and GitLab Dedicated customers require no action.

    Self-managed installations must prioritize immediate upgrades, as these vulnerabilities directly affect customer data security. The patches include database migrations that may affect upgrade processes.

    Single-node instances will experience downtime during updates, while multi-node installations can implement zero-downtime upgrades using proper procedures.

    GitLab researchers discovered most vulnerabilities through the HackerOne bug bounty program. The company commits to releasing security details 30 days after each patch on its public issue tracker.

    All affected organizations should review their current GitLab versions and deploy patches without delay to protect against these escalating security threats.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Multiple GitLab Vulnerabilities Let Attackers Inject Malicious Prompts to Steal Sensitive Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have uncovered a malicious Chrome extension that poses as a legitimate Ethereum wallet but harbors functionality to exfiltrate users’ seed phrases. The name of the extension is “Safery: Ethereum Wallet,” with the threat actor describing it as a “secure wallet for managing Ethereum cryptocurrency with flexible settings.” It was uploaded to the Chrome Web Store on

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Elastic Security has disclosed critical vulnerabilities affecting Kibana that could enable attackers to execute Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) attacks against vulnerable deployments.

    The vulnerabilities stem from inadequate origin validation in the Observability AI Assistant component.

    The primary vulnerability, tracked as CVE-2025-37734 under Elastic Security Advisory ESA-2025-24, involves an origin validation error in Kibana.

    This flaw allows attackers to forge Origin HTTP headers, bypassing security controls designed to prevent unauthorized requests from external sources.

    By exploiting this weakness, malicious actors can craft requests that trick Kibana into sending requests to unintended destinations or executing unintended actions.

    FieldDetails
    CVE IDCVE-2025-37734
    Vulnerability TypeOrigin Validation Error (SSRF)
    CVSS Score4.3 (Medium)
    Attack VectorNetwork
    Affected Versions8.12.0-8.19.6, 9.1.0-9.1.6, 9.2.0
    Patch Versions8.19.7, 9.1.7, 9.2.1

    The SSRF vulnerability enables attackers to access internal network resources or services that should remain isolated from external access.

    This can lead to information disclosure, lateral movement within networks, or further exploitation of backend systems.

    The vulnerability affects multiple Kibana versions, making it a widespread concern for organizations running affected deployments.

    Require Immediate Patching

    Elastic researchers report that the vulnerability only affects deployments actively using the Observability AI Assistant feature. The vulnerability impacts: Kibana 8.12.0 through 8.19.6, Kibana 9.1.0 through 9.1.6, and Kibana 9.2.0.

    Organizations without this component enabled are not affected by this flaw, which has a medium severity rating (CVSS v3.1 score of 4.3).

    While this may seem moderate, the impact should not be underestimated given the potential for unauthorized internal network access and data manipulation.

    Elastic has released patched versions addressing this vulnerability. Organizations should immediately upgrade to: Kibana 8.19.7, Kibana 9.1.7, and Kibana 9.2.1.

    Elastic Cloud Serverless customers are already protected, as continuous deployment and patching models remediated this vulnerability before public disclosure.

    Organizations unable to upgrade immediately should consider turning off the Observability AI Assistant feature until patches can be applied.

    Additionally, implementing network segmentation and access controls can help limit the potential impact of SSRF exploitation.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Multiple Kibana Vulnerabilities Enables SSRF and XSS Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶