• In a historic breach of China’s censorship infrastructure, over 500 gigabytes of internal data were leaked from Chinese infrastructure firms associated with the Great Firewall (GFW) in September 2025. Researchers now estimate the full dump is closer to approximately 600 GB, with a single archive comprising around 500 GB alone. The material includes more than […]

    The post Massive Great Firewall Leak Exposes 500GB of Censorship Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • WhatsApp has unveiled passkey-encrypted backups, simplifying the protection of cherished chat histories without the burden of memorizing complex passwords.

    This feature allows users to secure their end-to-end encrypted backups using biometric methods like fingerprints, facial recognition, or device screen locks, ensuring seamless access even after losing a phone or switching devices.

    Announced on October 29, 2025, the update addresses a long-standing pain point for the app’s over three billion users, who often store years of photos, voice notes, and conversations in backups on Google Drive or iCloud.​

    Passkeys represent a passwordless authentication evolution, leveraging device-specific biometrics to generate unique cryptographic keys that remain secure on the user’s hardware.

    Unlike the previous system introduced in 2021, which required a custom password or a cumbersome 64-digit encryption key, this new method integrates directly with the phone’s built-in security features for effortless encryption.

    WhatsApp Passkey Encryption for Chat

    Users can now encrypt backups with a simple tap or glance, applying the same robust end-to-end encryption that safeguards live chats and calls against access by WhatsApp, Meta, or third-party cloud providers.

    This innovation not only enhances convenience but also reduces risks associated with forgotten credentials, which previously could lock users out of their data entirely.

    Security experts note that passkeys are more resistant to phishing and credential stuffing attacks than traditional passwords, making them a forward-thinking choice for mobile messaging.​

    With cyber threats escalating, including recent spyware exploits targeting messaging apps, protecting stored data has never been more critical.

    WhatsApp’s encrypted backups ensure that personal memories and sensitive exchanges remain private, even if a device is compromised or stolen. The feature builds on the platform’s pioneering 2021 rollout of end-to-end encryption for backups, which now secures over 100 billion daily messages for two billion users.

    By eliminating reliance on easily lost keys, passkeys democratize advanced security, empowering non-technical users to maintain privacy without compromising on protection.

    This move aligns with broader industry trends toward biometric and zero-knowledge authentication, potentially setting a standard for other apps handling personal data.​

    The passkey encryption will deploy gradually worldwide on iOS and Android over the coming weeks and months, starting with the latest app versions. To enable it, users should navigate to Settings > Chats > Chat backup > End-to-end encrypted backup and select the passkey option.

    WhatsApp encourages immediate updates to stay ahead of the rollout, emphasizing that this enhancement keeps backups as secure and accessible as everyday chats.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post WhatsApp Introduces Passkey Encryption for Enhanced Chat Message Backup Security appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security researchers have uncovered a sophisticated attack vector that exploits how AI search tools and autonomous agents retrieve web content. The vulnerability, termed “agent-aware cloaking,” allows attackers to serve different webpage versions to AI crawlers like OpenAI’s Atlas, ChatGPT, and Perplexity while displaying legitimate content to regular users. This technique represents a significant evolution of […]

    The post New Agent-Aware Cloaking Technique Uses ChatGPT Atlas Browser to Feed Fake Content appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Cybersecurity and Infrastructure Security Agency (CISA), working alongside the National Security Agency and international cybersecurity partners, has released a comprehensive security guidance document focused on hardening Microsoft Exchange servers against evolving threats. The Microsoft Exchange Server Security Best Practices guide aims to help network defenders and IT administrators strengthen their on-premises Exchange infrastructure and […]

    The post CISA Publishes New Guidance to Strengthen Microsoft Exchange Server Security appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated phishing campaign leveraging multilingual ZIP file lures has emerged across East and Southeast Asia, targeting government institutions and financial organizations with unprecedented coordination. Security researchers utilizing Hunt.io’s AttackCapture™ and HuntSQL™ datasets have uncovered an interconnected network of 28 malicious webpages operating across three language clusters, revealing a scalable, automation-driven infrastructure designed to deliver […]

    The post Malicious Multilingual ZIP Files Strike Banks and Government Offices appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A design firm is editing a new campaign video on a MacBook Pro. The creative director opens a collaboration app that quietly requests microphone and camera permissions. MacOS is supposed to flag that, but in this case, the checks are loose. The app gets access anyway. On another Mac in the same office, file sharing is enabled through an old protocol called SMB version one. It’s fast and

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated Linux kernel rootkit designed to slip past the defenses of Elastic Security, a leading endpoint detection and response (EDR) platform.

    Released on GitHub by researcher 0xMatheuZ, the rootkit employs advanced obfuscation techniques to evade YARA-based detection and behavioral monitoring.

    While presented strictly for educational purposes, Singularity underscores the evolving challenges in kernel-level threat detection, potentially informing both attackers and defenders in the cybersecurity arms race.

    Elastic Security, integrated with Elastic Defend, typically triggers over two dozen alerts during rootkit scans, including file quarantines and process terminations.

    Singularity counters this by fragmenting its code, randomizing identifiers, and staging payloads in memory, achieving full evasion during testing.

    Core capabilities include hiding processes from /proc, concealing files and directories with patterns like “singularity” or “matheuz,” masking TCP connections on port 8081, and enabling privilege escalation via custom signals or environment variables.

    It also features an ICMP-based backdoor for reverse shells triggered by specific packet sequences, alongside anti-analysis measures that block tracing and sanitize logs.

    Linux Rootkit Evades Elastic EDR Detection

    At the heart of Singularity’s success lies a multi-layered approach to static analysis evasion. Traditional rootkits falter on predictable strings and symbols that YARA rules target, such as “kallsyms_lookup_name” paired with “license=GPL” or hooks like “hook_getdents.”

    Singularity tool

    The rootkit’s Python-based obfuscator fragments these at compile-time, splitting strings into adjacent literals that the C compiler reassembles—e.g., transforming MODULE_LICENSE(“GPL”) into MODULE_LICENSE(“G” “P” “L”).

    This ensures functionality while rendering the binary’s strings non-contiguous for scanners, as verified by tools like strings and objdump showing no direct matches.

    Symbol name randomization takes it further, replacing suspicious prefixes (“hook_,” “fake_”) with innocuous, kernel-mimicking names like “sys_abjker_handler” or “kern_wopqls_helper.”

    A whitelist protects essential kernel APIs, and regex patterns extract functions for consistent renaming, sorted by length to avoid partial substitutions, MatheuZ said.

    Ftrace hooking functions, another common giveaway, receive similar treatment, renaming “fh_install_hook” to evade rules detecting two or more such patterns. These techniques collectively dismantle the 57 function-name signatures in Elastic’s generic rootkit rules.

    Beyond static tricks, Singularity fragments its compiled .ko file into 64KB XOR-encoded chunks using a random 16-byte key, stored alongside metadata for reconstruction.

    A custom loader, compiled statically, reassembles these in memory via memfd_create, an anonymous file descriptor that avoids disk artifacts.

    It employs direct syscalls (both 64-bit and legacy 32-bit via int $0x80) to invoke finit_module, sidestepping hooked libc functions. This memory-only loading resists on-disk scanning, with fragments deletable post-execution.

    Behavioral detection proves trickier, especially for the ICMP-triggered reverse shell. Elastic flags patterns like setsid with /dev/tcp/ in command lines or shell executions from kernel workers.

    Singularity counters by writing a staged bash script to /singularity, hiding the spawning kworker PID immediately, then executing a clean /bin/bash /singularity.

    The script opens a TCP descriptor, spawns sh in the background, and uses kill -59 on precise PIDs for targeted hiding and escalation, bypassing command-line scrutiny without affecting legitimate processes.

    Evades security Detection
    Evades security Detection

    Bonus evasions include compiling loaders in /tmp instead of monitored /dev/shm and automating the obfuscation pipeline for reproducibility. In tests, Singularity loaded undetected, hid processes, and established root shells, proving its mettle against current Elastic rules.

    This work highlights the fragility of signature-based defenses against adaptive threats. As EDRs evolve, such research pushes for holistic detection blending machine learning and anomaly analysis. For defenders, it signals the need for deeper kernel integrity checks; for researchers, it’s a blueprint for resilience.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Researchers Created a Linux Rootkit that Evades Elastic Security EDR Detection appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The morning after President Donald Trump vowed to “start testing our Nuclear Weapons,” his pick to lead U.S. Strategic Command fielded questions from senators who wondered what the president meant and what the nominee planned to do about it.

    “If confirmed in the role of the STRATCOM commander, my role would be to provide military advice, and I would look forward to working with the committee and policy members to inform the way ahead with respect to any testing, whether that's testing of our missile systems, or maturity associated with surety” of nuclear weapons, said Vice Adm. Richard Correll, a submariner and STRATCOM’s deputy commander.

    That was the gist of Correll’s testimony during his confirmation hearing Thursday as lawmakers tried to parse exactly what Trump meant when he called for immediate nuclear weapons testing “on an equal basis” via social media late on Wednesday. No one was quite sure what the president meant, but it’s been 33 years since the United States exploded a nuclear weapon. 

    Trump defended his position to reporters Thursday aboard Air Force One returning from a trip to Asia. 

    “We have more nuclear weapons than anybody. We don't do testing. We've halted it years, many years ago. But with others doing testing, I think it's appropriate that we do also,” he said.

    Last year, a nuclear weapons scientist from Los Alamos National Laboratory told NPR that "our assessment is that there are no system questions that would be answered by a test, that would be worth the expense and the effort and the time.”

    The president didn’t provide details on when or where testing would take place but said, “We have test sites; it'll be announced.”

    Robert Peters, a senior research fellow for strategic deterrence at the Heritage Foundation, told NPR that there was just one place where the U.S. could test a nuke: the Nevada National Security Site, about 60 miles northwest of Las Vegas.

    Back on Capitol Hill, senators, mostly Democrats, looked to Correll for clear answers on how he would advise the president on explosive nuclear testing or how its resumption could influence adversaries like China and Russia. 

    Sen. Jack Reed, D-R.I., ranking member of the Senate Armed Services Committee, lambasted Trump’s “confusing” policy change during the hearing and in a statement, calling it a "fundamental misunderstanding of our nuclear enterprise—it is the Department of Energy, not the Department of Defense, that manages our nuclear weapons complex and any testing activities.”

    “The United States would gain very little from such testing, and we would sacrifice decades of hard-won progress in preventing nuclear proliferation," Reed said in a statement.

    During the hearing, Sen. Mazie Hirono, D-Hawaii, worried such live testing would “push” nuclear power nations to test more.

    “We have a Stockpile Stewardship Program to ensure the safety and reliability of our nuclear weapons without explosive testing, and the program relies on supercomputer simulations, non-explosive experiments and technology. We have a lot of technology that keeps us ahead of our adversaries in terms of ensuring that our nuclear stockpile is actually reliable,” she said.

    Sen. Jacky Rosen, D-Nev., stressed the lasting effects of explosive nuclear testing. 

    “The Nevada Test Site, now known as the Nevada National Security Site, NNSS, was ground zero for the majority of the United States, explosive nuclear testing from 1951 to 1992…and my state of Nevada is still suffering the consequences,” Rosen said. “I will not let this happen, not on my watch. I will do everything I can in my power as a senator, as a United States citizen, to put a stop to this and protect families in my State of Nevada.”

    Correll said he “wouldn't presume to predict a response on the part of Russia or China” and as the hearing went on, vowed to provide data-informed advice on nuclear weapons testing, while also requesting classified meetings to answer senators’ concerns. 

    “I have always been driven by data and, to the best of my ability, provide forthright and candid advice. And I commit that that will not change going forward,” he said.

    Correll also supports the Stockpile Stewardship Program, “which has developed the science and tools necessary to certify the nuclear weapons stockpile without the need for full-scale nuclear weapons testing,” according to written responses to policy questions, 

    Republican senators were more tempered in their questioning, supporting the president’s statement by emphasizing the need for all kinds of nuclear testing on a regular schedule.

    Sen. Tim Sheehy, R-Mont., said “testing on an ‘equal basis,’ is an extremely reasonable ask of our military, and I think it's the least we can do.” 

    “In general, tests of all kinds, whether nuclear or conventional, don't just provide those benefits, but also can send a strong message of resolve and deterrence,” said Sen. Tom Cotton, R-Ark., “We saw the exact opposite effect at times during the last administration, when President Biden canceled routine tests of our Minutemen III missiles to avoid supposedly escalating tensions with China or Russia.”

    When asked about maintaining a nuclear testing schedule as a means of deterrence, Correll agreed. 

    The STRATCOM commander role is “responsible for the requirements associated with accuracy and effectiveness of the weapons and that then drives the services and other subject matter experts, analysis of the testing required to meet those objectives,” he said. “It is a really, really important aspect of demonstrating the reliability and credibility of our nuclear deterrent, and that's an essential attribute for deterrence…particularly in this era.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-41244 to its Known Exploited Vulnerabilities catalog. This local privilege escalation flaw affects Broadcom’s VMware Aria Operations and VMware Tools, with evidence of active exploitation in the wild.

    Security researchers and officials urge immediate patching to prevent potential ransomware and other attacks that could compromise virtualized infrastructures.

    The vulnerability, rated as Important with a CVSSv3 base score of 7.8, stems from a privilege defined with an unsafe action issue. It allows a malicious local actor with non-administrative access to a virtual machine (VM) to escalate their privileges to root on the same VM.

    This is particularly risky in setups where VMware Tools are installed and managed by Aria Operations with Software-Defined Management Platform (SDMP) enabled.

    Broadcom confirmed that suspected exploitation has already occurred, heightening concerns for organizations relying on VMware for cloud and on-premises virtualization.

    VMware Tools and Aria Operations Vulnerability

    At its core, CVE-2025-41244 exploits improper privilege-handling flaws in VMware Tools and Aria Operations. A low-privileged user on a compromised VM can leverage this flaw to gain full administrative control, potentially pivoting to broader network access or data exfiltration.

    The attack requires local access, meaning initial footholds, such as through phishing or unpatched endpoints, could serve as entry points.

    Broadcom’s analysis ties the issue to CWE-267 (Privilege Defined With Unsafe Actions), emphasizing how seemingly benign configurations can become attack surfaces. No workarounds exist, making timely updates essential.

    Affected components include VMware Tools versions prior to 12.5.4 and specific Aria Operations releases. For Linux users, open-vm-tools updates will roll out via vendors, while Windows 32-bit systems are covered in Tools 12.4.9 as part of the 12.5.4 bundle.

    CVE IDAffected ProductsCVSSv3 ScoreImpactFixed VersionsExploitation Status
    CVE-2025-41244VMware Aria Operations, VMware Tools7.8 (Important)Local privilege escalation to root on VMTools 12.5.4; Aria Operations patches per matrix; open-vm-tools via vendorsSuspected in-the-wild exploitation; added to CISA KEV catalog

    Mitigations

    CISA advises applying vendor patches immediately and following Binding Operational Directive (BOD) 22-01 for federal cloud services. Organizations unable to patch should consider discontinuing use of vulnerable products.

    This incident underscores the persistent targeting of virtualization platforms, which power much of today’s hybrid IT landscapes.

    Broadcom credited Maxime Thiebaut of NVISO for discovering and reporting the flaw, highlighting the role of collaborative security research.

    As ransomware campaigns increasingly exploit such vulnerabilities, enterprises must prioritize vulnerability management. With exploitation confirmed, unpatched systems remain prime targets delaying action could lead to severe operational disruptions.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post CISA Warns of VMware Tools and Aria Operations 0-Day Vulnerability Exploited in Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • An ambitious Air Force plan to acquire hundreds more advanced fighter jets for homeland defense over the next decade would require a blank check from Congress and expanding the tactical aircraft counted in their inventory, an official confirmed Thursday.

    The report submitted to Congress last week laid out plans for the service to have nearly 1,400 manned tactical aircraft by 2030, roughly 300 more than 1,160 jets in the total combat aircraft inventory today, an Air Force official told reporters. Overall, the service wants 1,558 to achieve its missions with high confidence and low risk. But that goal can only be reached if Congress funds the purchases.

    “What we're setting is really the bar for what is the possibility out there,” the official said. “Achieving those numbers assumes that we would have the fiscal resources to do that.”

    Defense One obtained a copy of the 24-page report, which laid out the service’s lofty goals and stated the service does not have “total obligation authority” to place the necessary orders. Additionally, it states, “Industry production limitations will also limit the USAF's ability to meet global force requirement.” Congress mandated the new strategy in the last National Defense Authorization Act. And while it did explain ongoing plans for its fighter jet structure and modernization efforts for aging aircraft, the plan’s success would require near-perfect conditions.

    “This is where we want to be in the future,” the official said. “Whether we're going to be able to get there, based on the realities of either industry or top line, will be a function of the process that we go through.”

    The Air Force also wants to change how Congress defines the number of fighter jets it’s required to keep in its inventory. The 2018 National Defense Authorization Act set a bottom limit of 1,145 fighter jets in the service’s primary mission aircraft inventory—or the number of aircraft needed to meet a unit’s mission requirement. In 2025, the service was allowed to temporarily reduce the number of aircraft required by 44, to allow for the planned retirement of some jets, but then was required to return to the original number.  

    In the service’s 2026 legislative proposal, the Air Force wants to change the “primary mission inventory” requirement to “combat-coded total aircraft inventory”: a broader term that would include primary mission, reserve, and back-up fighters.

    “In the context of assessing combat capacity, reporting ‘Combat Coded Total Aircraft Inventory’ (CCTAI)” provides a complete assessment of aircraft used to meet combat demands,” the report said.

    Defense experts who spoke to Defense One about the unclassified report said it excluded key budget details and didn’t provide enough of a build-up of tactical jets for future national security requirements. 

    “There's probably a lot of different opinions on whether it scratches the itch,” the Air Force official said. “For some, I think it absolutely will. I think there's probably some out there that it absolutely won't.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶