1010.cx

  • Zero-Auth Vulnerability Enables Cross-Tenant Access at DoD Contractor

    ·

    CVE/vulnerability, Cyber Security News, vulnerability

    A severe authorization vulnerability was recently discovered in Schemata, an AI-powered virtual training platform serving the United States Department of Defense. Security researcher Alex Schapiro, utilizing the open-source AI hacking agent Strix, identified a critical lack of API authorization. Backed by Andreessen Horowitz, Schemata holds active government contracts to provide immersive 3D simulations for various […]

    The post Zero-Auth Vulnerability Enables Cross-Tenant Access at DoD Contractor appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Malicious OpenClaw Skill Targets Agentic AI Workflows to Deploy RATs and Stealers

    ·

    AI, cyber security, Cyber Security News

    OpenClaw’s agent “skill” ecosystem to deliver both Remcos RAT and a cross‑platform stealer called GhostLoader by hiding malware inside a deceptive DeepSeek integration called “DeepSeek‑Claw.” The campaign shows how agentic AI workflows with high local privileges can be quietly hijacked through manipulated installation instructions rather than classic exploit chains. OpenClaw, formerly known as Clawdbot and […]

    The post Malicious OpenClaw Skill Targets Agentic AI Workflows to Deploy RATs and Stealers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution

    ·

    Palo Alto Networks has released an advisory warning that a critical buffer overflow vulnerability in its PAN-OS software has been exploited in the wild. The vulnerability, tracked as CVE-2026-0300, has been described as a case of unauthenticated remote code execution. It carries a CVSS score of 9.3 if the User-ID Authentication Portal is configured to enable access from the internet or any

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Vimeo Confirms Breach Exposing 119,000 Unique User Email Addresses

    ·

    cyber security, Cyber Security News, Data Breach

    Video hosting platform Vimeo has confirmed a data breach that exposed approximately 119,000 unique user email addresses, attributing the incident to a security compromise at Anodot, a third-party analytics vendor integrated with its systems. The breach came to light after the ShinyHunters extortion group listed Vimeo on its “pay or leak” portal in April 2026, […]

    The post Vimeo Confirms Breach Exposing 119,000 Unique User Email Addresses appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Remus Infostealer Adopts Lumma-Style Browser Key Theft to Bypass App-Bound Encryption

    ·

    cyber security, Cyber Security News

    Remus is a newly observed 64-bit infostealer that closely tracks the Lumma Stealer codebase while adding EtherHiding-based C2 resolution and a refined Application‑Bound Encryption (ABE) bypass for Chromium browsers. The first Remus activity dates back to early 2026, shortly after Lumma’s core operators were doxxed between August and October 2025, suggesting either a rebrand or […]

    The post Remus Infostealer Adopts Lumma-Style Browser Key Theft to Bypass App-Bound Encryption appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Attackers Bypass Azure AD Conditional Access Using Phantom Device Registration

    ·

    Azure, cyber security, Cyber Security News, vulnerability

    A recent authorized red team operation by Howler Cell has demonstrated a critical attack path that completely bypasses Microsoft Entra ID (Azure AD) Conditional Access. Azure Conditional Access acts as the primary gatekeeper for cloud identity security, enforcing access rules based on user location, device compliance, and calculated risk scores. However, by starting with a […]

    The post Attackers Bypass Azure AD Conditional Access Using Phantom Device Registration appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Ransomware Gangs Escalate Attacks on Aviation and Aerospace Sector

    ·

    cyber security, Cyber Security News, Ransomware

    Ransomware and data extortion groups are increasingly targeting the aviation and aerospace sector, exploiting interconnected systems, shared platforms, and identity-based access models to cause operational disruption and data compromise. Cyber risk across aviation has shifted beyond traditional IT incidents toward ransomware attacks, credential theft, and platform-level compromise. The aviation ecosystem relies heavily on shared IT […]

    The post Ransomware Gangs Escalate Attacks on Aviation and Aerospace Sector appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical Palo Alto Firewall Vulnerability Enables Attackers to Gain Root Privileges

    ·

    CVE/vulnerability, cyber security, Cyber Security News, vulnerability

    Palo Alto Networks has issued an urgent security advisory concerning a critical vulnerability affecting its PAN-OS software. Tracked as CVE-2026-0300, this high-severity security flaw carries a CVSS 4.0 base score of 9.3 and is currently experiencing limited active exploitation in the wild. The vulnerability allows unauthenticated, remote attackers to execute arbitrary code with full root […]

    The post Critical Palo Alto Firewall Vulnerability Enables Attackers to Gain Root Privileges appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Army turns to ‘hackathons’ to better connect dozens of weapons, systems

    ·

    Defense Systems
    The Army is opening a new front in its battle to get contractors to make their weapons and systems easier to connect: “hackathons.” 

    Later this month, the service will host some of its biggest vendors for the first of a series of one-day brainstorming sessions about how to integrate the command-and-control software for dozens of military systems.

    “Right to Integrate,” the service’s name for the effort, will ensure the Army’s battlefield and business systems can better share data and communicate, according to a Tuesday news release.

    “We’ve known for a long time that our systems, weapons, and sensors need to talk to each other so that we can dominate the battlefield,” Army Secretary Dan Driscoll said in the release. “The war in Ukraine showed the world that speed matters and an open architecture construct is highly effective in high-intensity warfare. We haven’t been moving fast enough.”

    The Ukrainian military requires that its drone, sensors, and weapons platforms all have a common operating system, while the U.S. has long allowed contractors to make custom systems that can’t easily connect to each other.

    “We have seen standards come and go in the department for decades, but are still beholden to sub-par implementation, closed and proprietary interfaces, or systems that lack the flexibility to adapt over time,” Alex Miller, the Army’s chief technology officer, said in the release.

    The service has tried to turn that around with its next-generation C2 platform, which is being built with an open-architecture approach. The hackathons are meant to help existing platforms deconflict their operating systems to be able to start talking to each other.

    Engineers and scientists from Anduril, Boeing, General Dynamics, L3Harris, Lockheed Martin, Northrop Grumman, Palantir, Perennial Autonomy, and RTX are all supporting with dozens of pieces of technology and equipment will meet up for the first event later this month at Fort Carson, Colo.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • US escort of ships through Hormuz is a ‘gift to the world,’ Hegseth says

    ·

    Threats
    The Trump administration has dubbed its military effort to escort commercial ships through the Strait of Hormuz “Project Freedom,” Defense Secretary Pete Hegseth said Tuesday, calling it “separate and distinct from Operation Epic Fury,” “defensive in nature,” and “temporary.”

    Hegseth said that Epic Fury, the war begun in February by the U.S. and Israel against Iran, is on pause during the ongoing ceasefire, erroneously asserting that the “clock stops” on the 60-day limit imposed by the War Powers Resolution on U.S. military campaigns without congressional approval. Even if the U.S. is no longer dropping bombs on Iran, its continued blockade is an act of war on its own.

    “As a direct gift from the United States to the world, we have established a powerful red, white and blue dome over the strait,” Hegseth said during a Pentagon press briefing.

    Two ships have transited the strait since escorts began Monday, Hegseth said. 

    There remain more than 1,550 commercial ships trapped in the Arabian Gulf, Gen. Dan Caine, chairman of the Joint Chiefs of Staff, said at the briefing.

    On Monday, Iran attacked U.S. forces with cruise missiles, drones, and small boats, which were countered by U.S. Navy and Army attack helicopters, Caine said.

    “Thus far, today is quieter,” he said.

    Hegseth and President Donald Trump have said multiple times that the rest of the world needs the strait more than the U.S. does, though the international community has deferred to the U.S., which began striking Iranian nuclear and conventional weapons facilities on Feb. 28, to take the lead in confronting Iran’s closing of the strait in response to those attacks.

    “As I've said before, the world needs this waterway a lot more than we do,” Hegseth said. “We're stabilizing the situation so commerce can flow again, but we expect the world to step up at the appropriate time, and soon we will hand responsibility back to you.”

    Hegseth did not offer a timeline for that transition. 

    Asked whether Iran’s attacks on U.S. ships in the strait would violate the ceasefire and restart strikes within the country, Hegseth deferred to Trump.

    “Ultimately, the president is going to make a decision whether anything were to escalate into a violation of a ceasefire,” he said.

    It’s unclear under what legal authority the president would resume strikes against Iran. His administration has offered several rationales for the war, some of which were contradicted by available evidence.

    On Friday, the administration gave Congress written notice that hostilities have “terminated,” as the 60-day deadline for Congress to vote on an authorization of military force passed. 

    “Despite the success of United States operations against the Iranian regime and continued efforts to secure a lasting peace, the threat posed by Iran to the United States and our Armed Forces remains significant,” Trump wrote in the letter, leaving the door open to more strikes.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

Previous Page
1 2 3 4 … 761
Next Page

1010.cx

cybersecurity / defense / intelligence