• Fortinet has disclosed a security vulnerability affecting its FortiOS operating system that could allow attackers with administrative privileges to execute unauthorized system commands by bypassing command line interface restrictions. The flaw, tracked as CVE-2025-58325, was discovered internally by Fortinet’s PSIRT team and published on October 14, 2025. Vulnerability Details The security weakness stems from an […]

    The post FortiOS CLI Bypass Flaw Lets Attackers Run Arbitrary System Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The United Kingdom faces an unprecedented cyber security crisis as the National Cyber Security Centre (NCSC) reports handling an average of four ‘nationally significant’ cyber attacks weekly.

    This alarming escalation represents a dangerous shift in the threat landscape, with the NCSC managing 204 nationally significant incidents in the twelve months ending August 2025, more than doubling from 89 attacks recorded in the previous year.

    The threat environment has reached critical proportions, with 18 incidents classified as ‘highly significant’ during the reporting period.

    These attacks carried the potential for severe disruption to essential services and infrastructure, marking an almost 50% increase from the previous year and continuing a three-year upward trend.

    The NCSC’s latest Annual Review reveals that over half of all 429 incidents handled required national-level coordination, underscoring the systematic nature of these threats against UK interests.

    A substantial proportion of these attacks originated from Advanced Persistent Threat (APT) actors, including both nation-state operatives and sophisticated criminal organizations.

    National Cyber Security Centre (NCSC) analysts noted the increasing complexity and persistence of these threat actors, who demonstrate advanced capabilities in targeting critical infrastructure, government systems, and private sector networks.

    The attacks have demonstrated significant impact potential across the UK’s national security apparatus, economic systems, and essential service providers.

    Dr Richard Horne, NCSC Chief Executive, emphasized that cyber security has evolved into a matter of business survival and national resilience.

    The escalating threat demands immediate action from business leaders, as hesitation represents a fundamental vulnerability that attackers readily exploit.

    Government Response and Industry Collaboration

    The severity of the situation has prompted direct government intervention, with official correspondence sent to chief executives and chairs of major UK businesses, including all FTSE350 companies.

    This coordinated approach aims to establish cyber resilience as a board-level responsibility while fostering collaboration between government and private sector entities.

    The NCSC has simultaneously launched the Cyber Action Toolkit, specifically designed to assist small organizations in implementing foundational security controls against common threats.

    The initiative includes promotion of the Cyber Essentials certification scheme, which provides automatic cyber liability insurance for qualifying UK organizations with annual turnover below £20 million, creating financial incentives for proper security implementation across the business landscape.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post NCSC Warns of UK Experiencing Four Cyber Attacks Every Week appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The defense industry must produce counterdrone technology quickly—and in high numbers—to stay ahead of a potential drone threat. But delicate supply chains can make it harder for some companies to meet demand—even if their tech meets the Army’s needs. 

    “I have a lot of niche capabilities that are out there, but we may be challenged in scaling from an industrial perspective,” Col. Marc Pelini, who leads the Army’s air and missile defense cross-functional team, said during a counterdrone panel at the Association of the U.S. Army’s annual conference Monday.

    “If you look at some of the open source reporting on what's been going on in Ukraine and Russia the last few months—I think this figure I saw, in August, the Russians used up to 30,000 first person view drones. So, the scale is absolutely one of the most critical elements, which gets to some of the other comments about being able to try multiple different approaches to be able to attack it from different vectors,” said Brig. Gen. Glenn Henke, commandant for U.S. Army Air Defense Artillery and deputy commanding officer for Fort Sill’s Fires Center of Excellence.

    Eprius, which makes a series of high-powered microwave non-kinetic weapons, is acutely aware of how hard high-output production is, especially with supply chain constraints around high-powered amplifiers. But Andy Lowery, Epirus’ CEO, wants to be ready once the Army and other government customers decide on a program of record for counterdrone tech. 

    “Primarily this year has been about a year preparing to scale,” he said. “That is a major problem for us.”

    The company, which has a manufacturing plant in Torrance, Calif., wants to expand capacity with a new facility that Lowery hopes to announce a final location for in the summer of 2026. But in the nearterm, Epirus is leaning on its partnership with General Dynamics to double production ability. 

    “We've got seven systems in progress right now. But if 70 were to be the ask? One of our systems has 148,000 parts in it—15,000 are build-to-print, 135,000 are commercial-off-the-shelf. It is not easy to swing from seven to 70,” Lowery previously told Defense One.

    The details aren’t completely ironed out, but the goal is to have General Dynamics, which Epirus teamed up with for a manned and unmanned version of its high-powered microwave, do a lot of the metal work. 

    “As a manufacturing prime, we have substantial capacity to produce and ramp up at scale manufacturing of new equipment. Early on, our partnership with Epirus was far more just in the lines of ‘Hey, they had a powerful capability that they thought would integrate onto our Stryker,’” 

    G. Scott Taylor, who leads business development for General Dynamics Land Systems, told Defense One. “We would build a lot of the framework around it, and they would continue and focus on building the [line replaceable amplifier modules] themselves.” 

    If successful, Lowery hopes to replicate the model regionally, letting prime defense contractors do the “heavy lifting” more locally. 

    Established defense contractors partnering with newer companies isn’t new, but could become increasingly necessary as the Pentagon encourages more contracts with non-traditional companies that may not have the experience or capacity to make high quantities of what the military needs.  

    “If you didn't already have the factory, a lot of these guys are saying, ‘Why do I want to build my own factory…So we step in at times,” even for larger companies like Boeing or Viasat, when “there's synergy with our product line or with our customer base,” said Mike Sheehan, president and CEO for Thales Defense & Security, Inc.  and security. 

    Besides doing metalwork, bigger contractors can shoulder some of the certification requirements, like auditable accounting systems. 

    “One sort of ironic thing about your traditional defense companies, and then your non-traditional defense companies: traditional defense contractors need to be certified. [Your] cost accounting system needs to be certified; you get audited regularly. DCMA, DCAA, they monitor your rates. They limit how much profit you can make on fixed-price jobs and all that. And it's a tremendous amount of work and overhead on both the government side and industry side to keep that going.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The GhostBat RAT campaign leverages diverse infection vectors—WhatsApp, SMS with shortened URLs, GitHub-hosted APKs, and compromised websites—to distribute malicious Android droppers. Once installed, these droppers employ multi-stage workflows, deliberate ZIP header manipulation, and heavy string obfuscation to evade antivirus detection and reverse‐engineering. The threat actors utilize native libraries (.so) to dynamically resolve API calls and […]

    The post GhostBat RAT Android Malware Poses as Fake RTO Apps to Steal Banking Data from Indian Users appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft has disclosed a critical remote code execution flaw in its Internet Information Services (IIS) platform, posing risks to organizations relying on Windows servers for web hosting.

    Tracked as CVE-2025-59282, the vulnerability affects the Inbox COM Objects handling global memory, stemming from a race condition and use-after-free error.

    Announced on October 14, 2025, it carries a CVSS 3.1 base score of 7.0, rated as “Important” by Microsoft.

    While not yet exploited in the wild, security experts warn that its potential for arbitrary code execution could enable attackers to compromise server integrity, steal data, or pivot to broader network attacks.

    The flaw arises during concurrent execution where shared resources lack proper synchronization, allowing an unauthorized attacker to manipulate memory states.

    According to the CVE details, exploitation requires local access but can originate from a remote adversary who tricks a user into opening a malicious file.

    No privileges are needed, though the high attack complexity demands winning a precise race condition, making it challenging yet feasible for skilled threat actors.

    Microsoft IIS Vulnerability

    At its core, CVE-2025-59282 exploits weaknesses in CWE-362 (race condition) and CWE-416 (use-after-free) within IIS’s COM object management.

    When a user interacts with a crafted file, such as a specially malformed document or script, the vulnerability triggers improper memory handling.

    This leads to a use-after-free scenario where freed memory is accessed concurrently, enabling code injection.

    The CVSS vector string, CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, highlights key factors: local attack vector, high complexity, required user interaction, and high impacts across confidentiality, integrity, and availability.

    Microsoft clarifies that “remote” in the title refers to the attacker’s position, not the execution site, distinguishing it from fully remote exploits.

    No proof-of-concept code has been publicly released, but researchers note similarities to past IIS memory issues, where attackers could escalate to system-level control.

    Affected versions include Windows Server editions with IIS enabled, though Microsoft has not specified exact builds in initial advisories.

    Successful exploitation could allow attackers to run arbitrary code with the privileges of the IIS process, often running as SYSTEM on misconfigured servers.

    In enterprise environments, this might expose sensitive web applications, databases, or API endpoints to ransomware deployment, data exfiltration, or lateral movement.

    For instance, a compromised IIS server in a corporate intranet could serve as an entry point for advanced persistent threats targeting financial or healthcare sectors.

    Given the “Exploitation Unlikely” assessment from Microsoft’s MSRC, immediate threats remain low. However, the lack of patches at disclosure time urges urgent updates.

    No indicators of compromise (IoCs) have been detailed yet, but monitoring for unusual COM object interactions or memory anomalies in IIS logs is advised.

    Mitigations

    The simplest defense is disabling IIS if unused, as unaffected systems face no risk. Microsoft recommends applying forthcoming patches via Windows Update and restricting file execution policies.

    Enabling User Account Control (UAC) and auditing COM interactions can further harden defenses.

    Security firm researchers, including acknowledgers Zhiniang Peng from HUST and R4nger from CyberKunLun, emphasize timely patching to prevent escalation.

    As IIS powers millions of web servers, this vulnerability underscores the need for vigilant memory-safe coding in legacy components. Organizations should scan environments and review web server configurations promptly.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft IIS Vulnerability Allows Unauthorized Attacker To execute Malicious Code appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The China-backed advanced persistent threat group Flax Typhoon maintained year-long access to an ArcGIS system by turning trusted software into a persistent backdoor—an attack so unique it prompted the vendor to update its documentation. The attackers repurposed a legitimate Java server object extension into a web shell, gated access with a hardcoded key, and embedded […]

    The post Chinese Hackers Use Geo-Mapping Tool for Year-Long Persistence appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have disclosed two critical security flaws impacting Red Lion Sixnet remote terminal unit (RTU) products that, if successfully exploited, could result in code execution with the highest privileges. The shortcomings, tracked as CVE-2023-40151 and CVE-2023-42770, are both rated 10.0 on the CVSS scoring system. “The vulnerabilities affect Red Lion SixTRAK and VersaTRAK

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Veeam Software has disclosed three serious security flaws in its Backup & Replication suite and Agent for Microsoft Windows, which enable remote code execution and privilege escalation, potentially compromising enterprise backup infrastructures.

    These vulnerabilities, patched in recent updates, primarily affect domain-joined systems in version 12 of the software. Organizations are urged to apply fixes immediately to prevent potential data breaches or ransomware exploitation.

    CVE IDDescriptionSeverityCVSS v3.1 ScoreAffected VersionsPatched Version
    CVE-2025-48983Veeam Backup & Replication 12.3.2.3617 and all earlier versions 12 buildsCritical9.9Veeam Backup & Replication 12.3.2.3617 and all earlier version of 12 builds12.3.2.4165 Patch
    CVE-2025-48984Vulnerability allowing RCE on the Backup Server by an authenticated domain userCritical9.9Veeam Agent for Microsoft Windows 6.3.2.1205 and all earlier versions 6 builds12.3.2.4165 Patch
    CVE-2025-48982Local Privilege Escalation in Veeam Agent for Microsoft Windows if an administrator is tricked into restoring malicious fileHigh7.3Local Privilege Escalation in Veeam Agent for Microsoft Windows if administrator is tricked into restoring malicious file6.3.2.1302

    Mount Service RCE Threatens Backup Hosts

    The first critical issue, CVE-2025-48983, resides in the Mount service of Veeam Backup & Replication, allowing an authenticated domain user to execute arbitrary code on backup infrastructure hosts.

    With a CVSS v3.1 score of 9.9, this flaw was reported by CODE WHITE and impacts all version 12 builds up to 12.3.2.3617, including unsupported older releases, which are likely vulnerable.

    Veeam notes that only domain-joined configurations are at risk, while the Veeam Software Appliance and forthcoming version 13 remain architecturally unaffected.

    The patch, build 12.3.2.4165, resolves the issue by hardening the service against unauthorized code injection. Administrators are advised to follow Veeam’s best practices, favoring workgroup setups over domain integration for enhanced security.

    Backup Server Exposed To Domain User Attacks

    Similarly severe is CVE-2025-48984, another RCE vulnerability targeting the Backup Server itself, exploitable by authenticated domain users with a perfect 9.9 CVSS score.

    Discovered by Sina Kheirkhah and Piotr Bazydlo of watchTowr, it shares the same affected versions as CVE-2025-48983, limited to domain-joined Veeam Backup & Replication v12 environments.

    Unsupported versions should be treated as vulnerable, though not explicitly tested. The same patch, 12.3.2.4165, eliminates this risk, emphasizing the need for swift updates in hybrid or Active Directory-integrated setups.

    This flaw underscores the dangers of over-privileged domain access in backup systems, potentially enabling lateral movement across networks.

    Agent’s Restore Flaw Enables Privilege Escalation

    Complementing the RCE issues, CVE-2025-48982 affects Veeam Agent for Microsoft Windows, permitting local privilege escalation if an administrator restores a malicious file, rated high severity at 7.3 CVSS.

    Reported anonymously via Trend Micro’s Zero Day Initiative, it hits versions up to 6.3.2.1205, integrated with Backup & Replication or standalone.

    Exploitation requires tricking a user into restoration, but could elevate attacker privileges significantly. Fixed in build 6.3.2.1302, this patch is crucial for endpoint protection in Windows environments.

    Veeam recommends verifying all agent instances and isolating backups to mitigate social engineering risks. Organizations using affected versions should prioritize updates to safeguard against code execution threats.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Critical Veeam Backup RCE Vulnerabilities Let Attackers Execute Malicious Code Remotely appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have disclosed that a critical security flaw impacting ICTBroadcast, an autodialer software from ICT Innovations, has come under active exploitation in the wild. The vulnerability, assigned the CVE identifier CVE-2025-2611 (CVSS score: 9.3), relates to improper input validation that can result in unauthenticated remote code execution due to the fact that the call center

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft officially ended support for Windows 10 on October 14, 2025, leaving millions of users worldwide facing critical security concerns. The decision marks the end of regular technical assistance, feature updates, and security patches for one of the most widely used operating systems in history. Growing Security Vulnerabilities Put Users at Risk Without ongoing security […]

    The post End of Support for Windows 10 Sparks Security Fears Among Millions of Users appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶