• Security researchers are tracking a high-severity malware campaign that uses weaponized PDF files to distribute the Winos 4.0 malware. The threat actors impersonate government departments to trick users into opening malicious documents that infect Microsoft Windows machines. The campaign, first observed in early 2025, has since expanded its operations from Taiwan to Japan and Malaysia, […]

    The post Winos 4.0 Malware Uses Weaponized PDFs Posing as Government Departments to Infect Windows Machines appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • China’s top intelligence agency on Sunday accused the U.S. National Security Agency of carrying out a yearslong cyberespionage campaign against Beijing’s national time-service network, among the nation’s most sensitive pieces of digital infrastructure.

    China’s Ministry of State Security said the alleged intrusion began in early 2022 when NSA targeted the National Time Service Center, which keeps and broadcasts China’s standard time, including to telecommunications, finance, transportation, and defense organizations. 

    Investigators allege the hackers deployed 42 “specialized cyberattack weapons” to maintain persistence and extract network data. An overseas phone provider was exploited to gain initial access, China said, without naming the specific company. From there, U.S. cyberspies were able to access staff members’ mobile devices and other timekeeping systems, China further alleged.

    “NSA does not confirm nor deny allegations in the media regarding its operations,” an NSA official told Nextgov/FCW. “Our core focus is countering foreign malign activities persistently targeting American interests, and we will continue to defend against adversaries wishing to threaten us.”

    The NSA is an intelligence agency under the Department of Defense that employs various hacking, codebreaking, and eavesdropping capabilities to gather data on adversaries around the world. 

    In a media statement, the U.S. embassy in Beijing said that China “is the most active and persistent cyber threat to U.S. government, private-sector and critical infrastructure networks.” It did not address the specific accusations.

    The Chinese intelligence agency has not released forensic samples or indicators of compromise related to the National Time Service Center. It said the U.S. has “repeatedly hyped up the ‘China cyber threat’ theory, coercing other countries to hype up so-called ‘Chinese hacker attacks,’ sanctioning Chinese companies and prosecuting Chinese citizens in an effort to confuse the public and distort the truth.”

    The claims illustrate years of ongoing cyber tit-for-tat between Washington and Beijing, advanced nations capable of deploying cyber capabilities against each other at any given time. 

    In recent years, China has breached troves of telecommunications networks and other critical infrastructure systems in the U.S. and around the world. Around a decade ago, documents revealed by former NSA contractor Edward Snowden showed the spy agency had infiltrated the networks of Huawei, a major Chinese telecom operator. In April, Chinese authorities accused the NSA of launching attacks against networks tied to the Asian Winter Games that were held in February.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Trump denies Tomahawks to Ukraine. Instead of providing the long-range missiles he had dangled before a two-hour Friday meeting with Ukrainian President Volodymyr Zelenskyy, President Donald Trump pushed off a decision and urged both sides to “stop the war immediately.” He later posted online: “They should stop where they are. Let both claim Victory, let History decide!”

    Still, Zelenskyy characterized the meeting as positive, AP reported. “In my opinion, he does not want an escalation with the Russians until he meets with them,” the Ukrainian told reporters. “We share President Trump’s positive outlook if it leads to the end of the war. After many rounds of discussion over more than two hours with him and his team, his message, in my view, is positive — that we stand where we stand on the line of contact, provided all sides understand what is meant.” Some Ukrainians saw the denial as a blow

    Russia’s Vladimir Putin had phoned Trump on Thursday. Among other things, the Washington Post reported, Putin demanded “that Kyiv surrender full control of Donetsk, a strategically vital region in eastern Ukraine, as a condition for ending the war, two senior officials familiar with the conversation.” That “suggests he is not backing away from past demands that have left the conflict in a stalemate, despite Trump’s optimism about securing a deal, the officials said, speaking on the condition of anonymity to describe sensitive closed-door discussions.”

    Putin wants Trump to cede what his forces have been unable to capture. Russian-backed separatists since 2014 and Russia’s military since 2022 have sought to conquer the Donetsk Oblast, a heavily fortified region that includes vital portions of Ukraine’s defense industry. “Russian forces currently have no available means of rapidly enveloping or penetrating the fortress belt, which would likely take several years to seize at their current rate of advance,” the Institute for the Study of War posted on Sunday. “Ceding Donetsk Oblast to Russia would allow Russian forces to avoid a long and bloody struggle and continue fighting into deep rear areas of Ukraine from new positions…”

    Putin initiated the phone call, a move the New York Times called “a telling acknowledgment of a Russian priority as important as any battlefield in Ukraine: appeasing Mr. Trump. Even as Mr. Putin has pounded Ukrainian cities and waged grinding warfare in the country’s east, he has invested dozens of hours into flattering Mr. Trump, dangling the prospect of Russian-American business deals and sending the message that Russia is open to talks to end its invasion. 

    “The tactic has helped Mr. Putin head off repeated deadlines and sanction threats by the American president without curtailing Russia’s war effort.” Read more about Putin’s approach to Trump, here.

    Ukrainian strike closes Russian gas plant. ABC News: “Ukrainian drones struck a major gas processing plant in southern Russia, sparking a fire and forcing it to suspend its intake of gas from Kazakhstan, Russian and Kazakh authorities said Sunday.” The Orenburg plant is one of the largest in the world. “Kyiv has ramped up attacks in recent months on Russian energy facilities it says both fund and directly fuel Moscow’s war effort,” ABC wrote, here.

    Welcome to this Monday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Bradley Peniston and Lauren C. Williams. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1922, Army test pilot Lt. Harold Harris became the first person to bail out of a plane and survive using a parachute.

    Caribbean ops

    7th deadly strike. On Sunday, Defense Secretary Pete Hegseth said Thursday’s strike on a boat in the Caribbean Sea had killed “three male narco-terrorists” on “a vessel affiliated with Ejército de Liberación Nacional (ELN), a Designated Terrorist Organization.” He said the boat was “known by our intelligence to be involved in illicit narcotics smuggling,” but provided no evidence.

    Two people survived the strike, a first for the no-notice strikes on vessels in international waters, which have killed 27. The Trump administration is returning the survivors to their home countries of Colombia and Ecuador, the New York Times reported

    The strikes have caused a rift between the United States and Colombia, which CNN says had “previously been Washington’s most reliable ally in South America on national security and defense.” President Gustavo Petro has complained about the strikes, which he—and many legal experts—have called illegal assaults on his country’s citizens. On Sunday, Trump responded by saying that he would end some form of U.S. aid to Colombia. “The US has provided about $210 million in assistance to Colombia this fiscal year, including about $31 million in agricultural support, according to data from the US Department of State. It was not immediately clear which payments Trump was referring to Sunday,” CNN wrote.

    Gaza

    Sunday violence shakes Gaza ceasefire. Militants in Gaza fired an anti-tank missile at Israeli forces, killing two troops, said Israeli officials, who said they responded with strikes on Hamas targets including field commanders, gunmen, a tunnel, and weapons depots. On Monday, CNN reported that the Israeli strikes had killed at least 44 people. Reuters: “At least one strike hit a former school sheltering displaced people in the area of Nuseirat, residents said.” More, here.

    Both sides subsequently committed to uphold the week-old ceasefire, which each blaming the other for breaking. More from CNN, here.

    The White House rushed mediators to the region, including envoy Steve Witcoff and Trump son-in-law Jared Kushner, and Vice-President JD Vance was to arrive on Tuesday. Reuters reported that they “were expected to push to shore up the truce and then start talks on the next, more difficult, phase of the 20-step plan during their visit.”

    Around the Defense Department

    Army to build $50 million border fence along Arizona military training range. The Army Corps of Engineers began building 15 miles of border fence along the Barry M. Goldwater Training Range in Yuma, Ariz., yesterday, the Army’s civilian installations boss, Defense One’s Meghann Myers reports. The fence will replace existing easily penetrable mesh fencing on the southern border with Mexico, where crossings have forced some shutdowns of pilot and ground crew training. “When incursions occur and illegal border crossers get into that area, the ranges must close,” Jordan Gillis, the assistant Army secretary for energy and installations, told reporters. “That delays the training exercises. It diverts our time and our resources and ultimately impacts readiness.” Read on, here

    Upgraded comms? In more Army news, the service plans to test its next-generation command and control prototype for the second time since awarding the contract in July. The 4th Infantry Division will kick off Ivy Sting 2 at Fort Carson, Colo., where soldiers will test how the system handles deconflicting airspace before firing weapons and other scenarios, Myers reports. “How can we have the commanders doing their updates, doing their planning, but more importantly, how can we then enact that plan and shorten the time it takes to conduct fires?” Zach Kramer, head of Anduril’s mission command office, told Defense One. Here’s the full story.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical zero-click vulnerability in Dolby Digital Plus (DDP) audio decoding software has been disclosed, allowing attackers to execute malicious code remotely via seemingly innocuous audio messages.

    Google Project Zero’s Ivan Fratric and Natalie Silvanovich have identified an out-of-bounds write flaw in the DDPlus Unified Decoder, which processes evolution data in audio files.

    This bug stems from an integer overflow in length calculations, leading to an undersized buffer allocation. As a result, subsequent writes bypass bounds checks, potentially overwriting key struct members, including pointers processed in the next syncframe.

    The issue affects devices running the decoder, with severe implications for Android users due to automatic audio processing.

    The vulnerability, detailed in a recent bug report, highlights how modern messaging apps unwittingly expose users to remote code execution (RCE). On Android, the flaw enables attacks without any user interaction.

    Incoming RCS (Rich Communication Services) audio messages and attachments are decoded locally for transcription purposes, triggering the bug silently in the background.

    Potential Exploitation on Android Devices

    Android devices are particularly at risk because the Google Messages app and similar clients use the DDPlus decoder to handle audio content proactively.

    Attackers could craft malicious audio files, such as those in .ec3 or .mp4 formats, and send them via RCS. Once received, the target’s device processes the file automatically, potentially leading to a crash in the C2 (Codec 2.0) process or worse, arbitrary code execution if exploited further.

    Reproduction is straightforward for testers: By pushing a specially crafted file like “dolby_android_crash.mp4” into the messaging app’s cache on a sending device and initiating an RCS voice message, the target device crashes upon receipt.

    Researchers provided sample bitstreams, including one that targets 32-bit systems and another for 64-bit Android. This ease of exploitation underscores the urgency, as no user action like opening or playing the file is required.

    In real-world scenarios, phishing campaigns or targeted attacks via messaging could weaponize this for data theft, malware implantation, or device takeover.

    While patches remain unclear as of this report, Android users are advised to update their devices and messaging apps promptly. Google has not yet commented, but the 90-day disclosure window ended on September 24, 2025, making details public.

    The flaw extends beyond Android; code analysis reveals its presence in macOS implementations, though pre-processing steps may prevent exploitation there.

    Researchers are continuing to probe affected platforms, including potential impacts on iOS or other Dolby-integrated systems like smart TVs and streaming devices.

    volution data handling in DDP, designed for enhanced audio features, ironically becomes a vector for abuse in this case.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Dolby Digital Plus 0-Click Vulnerability Enables RCE Attack via Malicious Audio on Android appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A widespread Amazon Web Services (AWS) outage on Monday disrupted operations for millions of users worldwide, knocking out access to everything from streaming giants to social media platforms and financial apps.

    The incident, which began early in the morning, affected high-profile services like Amazon’s own e-commerce site, Snapchat, Prime Video, Canva, and countless others reliant on AWS infrastructure.

    Banks such as Capital One and airlines including Delta reported intermittent downtime, while delivery apps like DoorDash and media outlets faced loading delays. Frustrated users took to social media ironically, platforms like Twitter (now X) that weren’t directly hit—to share screenshots of error messages and frozen screens.

    The ripple effects were immediate and far-reaching. Snapchat users couldn’t refresh their feeds or send snaps, Prime Video subscribers encountered buffering issues during peak viewing hours, and Canva’s design tools became unresponsive for creators mid-project.

    Even lesser-known services, from indie game developers to small business websites, ground to a halt. “It’s like the internet’s backbone snapped,” one tech analyst tweeted, highlighting how AWS’s dominance in cloud computing amplifies such failures.

    By midday, reports estimated the outage cost affected companies millions in lost productivity and revenue.

    At the heart of this outage was DynamoDB, AWS’s popular NoSQL database service that stores vast troves of customer data for apps and websites. Amazon confirmed that access to DynamoDB was impaired due to a Domain Name System (DNS) failure within its ecosystem.

    DNS acts as the internet’s address book, translating human-readable URLs like “amazon.com” into numerical IP addresses that devices use to connect. When this “location engine” faltered, it created a cascade: services couldn’t resolve addresses, blocking data retrieval from DynamoDB and halting operations across dependent platforms.

    Recovery InProgress

    AWS engineers worked swiftly to mitigate the issue, restoring partial service to most regions by early afternoon. The company issued a statement apologizing for the inconvenience and promising a full root-cause analysis.

    “We’re investigating and will share more details soon,” an AWS spokesperson said. While no cyberattack was suspected pointing instead to an internal configuration error the event underscores the risks of over-reliance on a single provider.

    For businesses, this serves as a stark reminder to diversify cloud strategies. As outages like this expose vulnerabilities in our hyper-connected world, experts urge enhanced redundancy measures to prevent future blackouts from derailing daily life.

    Update: According to the recent status page update, most of the servies are active and the engineers actively working to address the issues.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post AWS Outage Impacts Amazon, Snapchat, Prime Video, Canva and More appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • It’s easy to think your defenses are solid — until you realize attackers have been inside them the whole time. The latest incidents show that long-term, silent breaches are becoming the norm. The best defense now isn’t just patching fast, but watching smarter and staying alert for what you don’t expect. Here’s a quick look at this week’s top threats, new tactics, and security stories shaping

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ClickFix, FileFix, fake CAPTCHA — whatever you call it, attacks where users interact with malicious scripts in their web browser are a fast-growing source of security breaches.  ClickFix attacks prompt the user to solve some kind of problem or challenge in the browser — most commonly a CAPTCHA, but also things like fixing an error on a webpage.  The name is a little misleading, though

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have uncovered a coordinated campaign that leveraged 131 rebranded clones of a WhatsApp Web automation extension for Google Chrome to spam Brazilian users at scale. The 131 spamware extensions share the same codebase, design patterns, and infrastructure, according to supply chain security company Socket. The browser add-ons collectively have about 20,905 active users. “

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A new proof-of-concept (PoC) has been released for a serious vulnerability tracked as CVE-2025-8941, affecting the Pluggable Authentication Modules (PAM) used across Linux distributions. The flaw, rated 7.8 (High) on the CVSS scale, allows local attackers to elevate privileges to root through a sophisticated race condition and symbolic link (symlink) manipulation. Discovered in the pam_namespace […]

    The post PoC Released for Linux-PAM Vulnerability Enabling Local Root Privilege Escalation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Canva, the popular graphic design platform, is reeling from a widespread outage that has rendered its services inaccessible to millions of users worldwide. As of 19:16 AEDT (02:46 IST), the platform’s status page reports “significantly increased error rates” impacting nearly all functionalities, with no clear timeline for restoration.

    The disruption, linked to a broader Amazon Web Services (AWS) failure, has sparked frustration among users from India to the U.S., halting workflows for marketers, designers, and educators.

    A Platform in Paralysis

    The outage began escalating around 18:14 AEDT (03:44 IST), with Canva’s status updates confirming “Major Outage” across critical features: login, editing, saving, downloading, and sharing designs.

    Mobile apps (iOS and Android), desktop versions (macOS and Windows), and integrations like Google Classroom and Moodle are also down. Even the Canva AI Connector, Apps SDK, and billing systems are affected, leaving users unable to access projects or seek support.

    DownDetector has recorded over 15,000 user complaints in recent hours, with 20% citing server connection issues and 17% reporting app failures.

    In India, where Canva is a go-to for festive graphics like Diwali campaigns, users expressed dismay on X: “Canva is down completely, app and web versions. Can’t log in,” one user posted. Another from the Philippines noted, “Ini-report ng netizens na hindi nila ma-access ang Canva ngayong Lunes.”

    AWS at the Core

    The root cause appears to be a failure in AWS’s US-EAST-1 region, where elevated error rates and latency were reported starting around 03:11 AM ET (12:41 IST).

    Canva, heavily reliant on AWS’s cloud infrastructure, is among several platforms affected, though the impact on its 220 million monthly active users is particularly acute.

    “Our team is actively investigating and working to restore full access as quickly as possible,” Canva’s status page states, a message unchanged since the initial alert.

    On X, #CanvaDown is trending as users vent and share memes about stalled projects. A U.S. marketer tweeted, “Was supposed to launch promo campaigns… Canva down, chaos!” An Indian agency head added, “@canva what is happening? It is a critical day!” The outage’s timing is especially painful for small businesses and freelancers, with one user estimating thousands in lost productivity.

    This marks Canva’s second major outage in six months, highlighting the risks of cloud-based platforms. As users wait for updates, the incident underscores the fragility of digital workflows. Canva advises checking its status page for progress, but for now, designers worldwide are left refreshing tabs and hoping for a swift fix. Updates will follow as more details emerge.

    Follow us on Google NewsLinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Canva Down – Suffers Global Outage, Leaving Millions of Users Unable to Access Platform appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶