• A security researcher has uncovered a significant vulnerability in a widely used payment terminal that could enable attackers to gain full control of the device in under a minute. The affected model, the Worldline Yomani XR, is found in grocery stores, cafes, repair shops, and many other businesses across Switzerland. Despite its reputation as a […]

    The post Credit Card Payment Terminal Exploited for Remote Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Organizations using Oracle E-Business Suite must apply the October 4 emergency patches immediately to mitigate active, in-the-wild exploitation by CL0P extortion actors and hunt for malicious templates in their databases. Beginning September 29, 2025, Google Threat Intelligence Group (GTIG) and Mandiant identified a massive email campaign targeting executives at dozens of organizations, alleging theft of […]

    The post Google Issues Alert on CL0P Ransomware Actively Exploiting Oracle E-Business Suite Zero-Day appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A threat actor is claiming responsibility for a data breach at KFC’s Venezuela operations, offering for sale a database containing the personal and order information of more than one million customers. The sale was advertised on a dark web forum on October 8, 2025, where the seller posted a 405 MB CSV file containing exactly […]

    The post KFC Venezuela Suffers Alleged Data Breach Exposing 1 Million Customer Records appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Two critical vulnerabilities in 7-Zip’s handling of ZIP archives have emerged, enabling remote attackers to execute arbitrary code by exploiting directory traversal flaws. Both issues stem from improper processing of symbolic links within ZIP files, allowing crafted archives to force traversal to unintended locations and ultimately run code under the context of vulnerable services. Directory […]

    The post 7-Zip Vulnerabilities Allowing Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Two high-severity vulnerabilities have been discovered in the popular open-source file archiver, 7-Zip, which could allow remote attackers to execute arbitrary code.

    Identified as CVE-2025-11001 and CVE-2025-11002, the flaws affect all versions of the software prior to the latest release and require immediate patching.

    The core of both vulnerabilities lies within the way 7-Zip handles symbolic links embedded in ZIP archives. According to the advisory, a threat actor can create a malicious ZIP file containing crafted data that exploits this weakness.

    When a user with a vulnerable version of 7-Zip attempts to decompress the archive, the flawed process can be manipulated to perform a directory traversal.

    This allows the extraction process to write files outside of the intended destination folder, potentially placing malicious payloads in sensitive system locations.

    While the attack is initiated remotely through the delivery of the malicious file, exploitation requires user interaction, as the victim must choose to open the archive. The specific attack vectors may vary depending on how 7-Zip is implemented within different environments.

    Both CVE-2025-11001 and CVE-2025-11002 have been assigned a CVSS 3.0 score of 7.0, classifying them as high-severity threats.

    A successful exploit could allow an attacker to execute arbitrary code on the affected system with the privileges of the service account or user running the 7-Zip application.

    This could lead to a full system compromise, data theft, or the deployment of further malware such as ransomware.

    The high complexity of the attack and the requirement for user interaction prevent the vulnerabilities from receiving a critical rating, but the potential impact on confidentiality, integrity, and availability remains significant given the widespread use of the 7-Zip utility.

    CVE IDAffected ProductVulnerabilityCVSS 3.0 Score
    CVE-2025-110027-Zip (versions before 25.00)Arbitrary Code Execution via Symbolic Link Handling7.0 (High)
    CVE-2025-110017-Zip (versions before 25.00)Arbitrary Code Execution via Symbolic Link Handling7.0 (High)

    The developer of 7-Zip has released version 25.00, which rectifies these security flaws. All users are strongly advised to update their installations immediately to protect against potential exploitation.

    The vulnerabilities were initially reported to the vendor on May 2, 2025, following a responsible disclosure timeline.

    A coordinated public advisory was subsequently released on October 7, 2025, to inform the public of the risks and the available patch. These vulnerabilities were uncovered by security researcher Ryota Shiga of GMO Flatt Security Inc., working with takumi-san.ai.

    Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today

    The post 7-Zip Vulnerabilities Allows Remote Attackers to Execute Arbitrary Code appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Army’s largest professional gathering kicks off Monday, traditionally a venue for the service to make big organizational announcements, like the advent of the black uniform beret or the launch of the Multi-Domain Operations concept. But with the government shut down and the Pentagon reining in public appearances by uniformed and civilian officials, it’s an open question how much the service will be able to participate in this year’s edition of the Association of the U.S. Army’s annual conference.

    As of Tuesday, an AUSA spokesman told Defense One, impact to Army participation will be “minimal.” [Editor’s note: CNN reported Thursday evening that AUSA has donated $1 million to enable the attendance of senior leaders whose travel and per diem funding is frozen by the shutdown.]

    An Army official told Defense One that the service has sought exceptions to the Pentagon’s new restrictions on public speaking so that Army leaders may speak to members of the press at the conference. 

    In addition to the standard panels and fireside chats, the 2025 AUSA annual meeting will feature a “Shark Tank”-like competition for developers to pitch their products, with a prize pool of $500,000. Winners will see their prototypes sent directly to the field for soldiers to try out. 

    “One of the things we know is we, the Army, are a bad customer for ourselves, but we're also a bad customer for industry. We give demand signals, but don't put dollars behind that,” Army Secretary Dan Driscoll told reporters last month. “And so small and medium businesses have a really hard time growing and scaling with us. And so we're going to change that.”

    The competition is a piece of the service’s larger FUZE program, which brings together xTech, the Small Business Innovation Research and Technology Transfer, the Manufacturing Technology and the Technology Maturation Initiative. The idea is that, like venture-capital firms, the Army will invest small amounts of money in buying existing technology and quickly unload what doesn’t work, rather than spending years developing the perfect product only to find it obsolete once it’s ready for fielding.

    The service is also poised to make some “massively substantive changes to how we buy our stuff,” Driscoll said. “For us, what that looks like is our soldiers and our contractors and the people who come up with our requirements, putting them all together, empowering them with these big, hairy problems, and saying, ‘Go fix this for the soldier’.” 

    Other officials are slated to present updates on a range of initiatives, including the Mobile Brigade Combat Team concept, counter-small unmanned aerial systems development, and electronic warfare—all part of the service’s ongoing Transformation-in-Contact program.

    On Tuesday, AUSA is to bring together the current and former commanders of U.S. Army North to talk about threats to the homeland, promising a rare public discussion on what has become the Defense Department’s top priority as the second Trump administration prepares to roll out its National Defense Strategy.

    Other scheduled events include updates on the long-awaited Next-Generation Command and Control and the newly formed Joint Task Force 401, the Army-led effort to rapidly procure counter-small drone systems for all of the services.

    NGC2, a joint venture by new-school contractors Anduril and Palantir, came under recent scrutiny after the Oct. 3 leak of an internal Army memo, first reported on by Breaking Defense, that warned of the system’s “significant risk to data, mission operations, and personnel by rendering the system vulnerable to insider threats, external attacks, and data spillage.”

    The concerns were compiled as part of a normal audit of the development process, Anduril founder and CEO Palmer Luckey told reporters Thursday. Since it was shared internally, Luckey said, Anduril has since upgraded NGC2 with security protocols like user authentication and recording, which were always available in its Lattice software.

    “The real answer is, we turned on all of the features that Lattice already had, which were not part of that initial prototype,” he said. “And the people who are planting that story are totally aware of that.”

    The Army has talked about turning this around in its acquisitions process for years, and using these Silicon Valley firms to do it. Driscoll said he feels confident something is actually going to change this time.

    “So from my perspective, I think if you look at the Army's budget of $185 billion, that is a lot of money, and we should be getting much better outcomes to the American people and the soldiers,” he said. “And this is not intended to disparage previous administrations. But my understanding from people who've been in the building for 30-plus years is, it actually is different this time, that we are able to do the right thing as we think soldiers define it.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • President Donald Trump’s novel use of National Guard troops for law enforcement purposes has reopened a debate over states’ authority to control police powers, as dueling briefs from current and former state leaders filed in Illinois’ lawsuit against the president show.

    A bipartisan group of former governors said Trump’s federalization and deployment of National Guard members to Chicago to control “modest” protests upended the careful balance between state and federal powers. 

    At the same time, a group of 17 current Republican attorneys general told the court they supported the administration’s move that they said was necessary to protect immigration enforcement officers.

    Both groups submitted friend-of-the-court briefs in the suit in the U.S. District Court for the Northern District of Illinois Eastern Division brought by Illinois Gov. JB Pritzker and Chicago Mayor Brandon Johnson to block the Trump administration’s deployment of National Guard troops to the nation’s third-largest city. 

    Trump on Wednesday called for the arrest of Johnson and Pritzker for not assisting Immigration and Customs Enforcement officers, a provocative demand that raised further concerns about his administration’s relationship with state leaders.

    The bipartisan group supported Pritzker and Johnson’s call for a restraining order to block the deployment, while the Republicans said the restraining order should be denied.

    Democratic attorneys general back Oregon 

    In another case, in which Oregon is challenging Trump’s order to deploy troops to Portland, Democratic governors or attorneys general in 23 states and the District of Columbia argued in support of the state’s position.

    Democratic Pennsylvania Gov. Josh Shapiro, who was among those siding with Oregon, said Wednesday he did so to “put an end to the dangerous overreach of power we are seeing with Donald Trump’s Guard deployments.”

    The brief was also signed by Democratic state officials from Washington state, Maryland, Arizona, Colorado, Connecticut, Delaware, Hawaii, Illinois, Maine, Massachusetts, Michigan, Minnesota, Nevada, New Jersey, New Mexico, New York, North Carolina, Rhode Island, Vermont, Wisconsin, Kansas and Kentucky and the District of Columbia’s attorney general.

    Former govs say deployment robs state authority

    The federalist structure of the U.S. government, which bestows powers to both the federal and state governments, leaves broad police power to the states, the bipartisan group wrote. 

    Sending military forces to conduct law enforcement would unbalance that arrangement, they said.

    That group includes Democratic former Govs. Jerry Brown of California, Steve Bullock of Montana, Mark Dayton of Minnesota, Jim Doyle of Wisconsin, Parris Glendening and Martin O’Malley of Maryland, Jennifer Granholm of Michigan, Christine Gregoire, Jay Inslee and Gary Locke of Washington, Tony Knowles of Alaska, Terry McAuliffe of Virginia, Janet Napolitano of Arizona, Deval Patrick of Massachusetts, Bill Ritter Jr. of Colorado, Kathleen Sebelius of Kansas, Steve Sisolak of Nevada, Eliot Spitzer of New York, Ted Strickland of Ohio, Tom Vilsack of Iowa and Tom Wolf of Pennsylvania.

    GOP former Govs. Arne Carlson of Minnesota, Bill Graves of Kansas, Marc Racicot of Montana, Bill Weld of Massachusetts and Christine Todd Whitman of New Jersey also signed the brief.

    “The present deployment of military resources, based on an assertion of nearly unfettered federal authority, is unlawful,” they wrote. “The president’s assertion of authority to deploy military troops on domestic soil based on his unreviewable discretion, and without the cooperation and coordination of state authorities, threatens to upset the delicate balance of state and federal authority that underlies our constitutional order.”

    The Trump administration misunderstands the section of federal law that Trump has relied on to federalize National Guard troops, the group said. 

    The administration’s claim that only the president can decide if the conditions are met for National Guard units to be federalized “not only undermines state sovereignty but also deprives governors of a critical public safety tool,” they wrote.

    “If federalization of the National Guard is unreviewable, a president motivated by ill will or competing policy priorities could divert Guard resources away from critical state needs, including natural disasters or public health crises,” they continued.

    States need ICE enforcement, GOP govs say

    The group of current Republican attorneys general argued their states are harmed by the protests in Chicago and other cities that impede federal ICE officers from doing their jobs.

    The attorneys general are Brenna Bird of Iowa, Austin Knudsen of Montana, Gentner Drummond of Oklahoma, Alan Wilson of South Carolina, Steve Marshall of Alabama, Tim Griffin of Arkansas, James Uthmeier of Florida, Chris Carr of Georgia, Raúl R. Labrador of Idaho, Todd Rokita of Indiana, Lynn Fitch of Mississippi, Catherine Hanaway of Missouri, Michael T. Hilgers of Nebraska, Marty Jackley of South Dakota, Ken Paxton of Texas and John B. McCuskey of West Virginia.

    They described the protests in Chicago as acts of violence that require a strong response.

    “Rather than protest peacefully, some of those protests became violent, threatening federal officers, harming federal property, and certainly impeding enforcement of federal law,” they wrote. “President Trump’s deployment of a small number of National Guard members to defend against this lawlessness is responsible, constitutional, and authorized by statute.”

    The attorneys general added that their states had been harmed by immigrants in the country without legal authorization who had settled in their states, which they said gave the president a public interest purpose in calling up troops to assist. 

    “The President’s action of federalizing the National Guard furthers the public interest because it allows ICE agents to continue to perform their statutory duties of identifying, apprehending, and removing illegal aliens, which is the only way to protect the States from the harms caused by illegal immigration,” they wrote.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft users are facing a novel quishing campaign that leverages weaponized QR codes embedded in malicious emails.

    Emerging in early October 2025, this attack exploits trust in QR-based authentication and device pairing workflows, tricking targets into scanning codes that deliver infostealer binaries.

    Initial reports surfaced when Gen Threat Labs analysts noted anomalous QR attachments spoofing Microsoft branding within corporate Office 365 notifications.

    Recipients who scanned the codes were redirected to a compromised Azure CDN node hosting a staged payload delivery sequence.

    Following its emergence, researchers identified multiple infection vectors. One involves a phishing email purporting to be a Microsoft Teams alert, instructing users to scan a QR code to resolve an urgent security issue.

    Another impersonates a Microsoft Authenticator enrollment prompt, promising “enhanced login protection” upon scanning. Because many organizations encourage QR-based multi-factor setup, these lures appear legitimate at first glance.

    Gen Threat Labs researchers noted that victims saw familiar Microsoft logos and correctly formatted links, increasing the campaign’s reach and success rate.

    The impact spans credential theft and system compromise. Once the QR code is scanned, victims receive a short URL that resolves to a malicious redirector script.

    This script performs environmental checks—verifying Windows locale, installed Defender versions, and sandbox indicators—before downloading aPackaged Infostealer (PI) executable.

    This binary establishes persistence by creating a scheduled task named “MSAuthSync,” ensuring execution at each user logon. Extracted credentials and host telemetry are exfiltrated over HTTPS to attacker-controlled endpoints.

    Infection Mechanism

    A key innovation in this quishing attack is its QR code AV evasion technique. Rather than embedding a single QR image, the malware splits the code into two overlapping images drawn via PDF content streams.

    Standard QR decoders ignore nonstandard color palettes and split segments, but the custom parser recombines image layers before decoding.

    The following Python snippet illustrates how a defender might reconstruct and decode such split QR codes:-

    from PIL import Image
    import zbarlight
    
    # Load the two image layers
    layer1 = Image.open('qr_part1.png').convert('RGB')
    layer2 = Image.open('qr_part2.png').convert('RGB')
    
    # Recombine by taking the brighter pixel from each
    merged = Image.new('RGB', layer1.size)
    pixels1, pixels2 = layer1.load(), layer2.load()
    for x in range(layer1.width):
        for y in range(layer1.height):
            pixels = pixels1[x, y] if sum(pixels1[x, y]) > sum(pixels2[x, y]) else pixels2[x, y]
            merged.putpixel((x, y), pixels)
    
    # Decode the merged QR code
    codes = zbarlight.scan_codes('qrcode', merged)
    print('Decoded URL:', codes[0].decode())

    This approach highlights how weaponized QR images can evade both static AV signatures and naive visual inspections, underscoring the need for layered analysis in modern phishing campaigns.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post New Quishing Attack With Weaponized QR Code Targeting Microsoft Users appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • You need to fix alarming mission-capability rates and rising sustainment costs for the Air Force’s F-35A fighter jet, senators told the service’s chief-of-staff nominee on Thursday.

    “The F-35 remains the most advanced fighter in the world, but too many of them are sitting idle on ramps. The readiness rates of our aircraft continue to fall short of Pentagon goals. This is known on this side of the ocean and around the world,” Sen. Roger Wicker, R-Miss., the Senate Armed Services Committee chairman, said during Thursday’s hearing. “The Air Force cannot protect power if its most advanced fighter cannot get off the ground.”

    The warning was directed at Gen. Kenneth Wilsbach, the former head of Air Combat Command and Pacific Air Forces, who was nominated last month to serve as the service’s top uniformed leader. The current Air Force chief of staff, Gen. David Allvin, unexpectedly announced in August that he would retire, effective in November, after his ties to a massive reorganization effort focused on China seemingly broke with the Pentagon’s renewed homeland focus.

    Wilsbach was not questioned by lawmakers about Allvin’s sudden departure and was not heavily grilled on the Trump administration’s domestic deployment of the National Guard or ongoing military actions against alleged drug-runners. Senators mainly focused on technical problems facing the Air Force—and in particular, the F-35’s parts and maintenance problems.

    F-35 maker Lockheed Martin has regularly delivered the jets late and without necessary upgrades, according to a Government Accountability Office report released last month. Between 2019 and 2023, mission-capable rates for the fifth-generation fighter have floated between 71 and 51 percent while sustainment costs ballooned, another GAO report found last year.

    Sen. Jack Reed, D-R.I., the SASC’s ranking member, told Wilsbach that idle F-35s need to get flying because pilots sitting “around in a simulator all day” will harm aviator retention. Wilsbach agreed and told the lawmakers that his service’s weapons-sustainment accounts need more money to fix the problem.

    “We definitely have to invest in those accounts so that the parts are on the shelves when the aircraft flies,” the general said. “The problem with the F-35 is now they have to wait for the part to be shipped…All that time where it's sitting waiting for that part is downtime where we can't use the aircraft to train.”

    The 2026 defense budget working through the cogs of Congress would allow for the purchase of 47 F-35s, including two dozen A-models for the Air Force. The massive defense-focused reconciliation spending bill passed this summer included no additional funding for the F-35. Discretion for implementing those funds ultimately falls to the Defense Department.

    When asked by Wicker if Wilsbach would “carry out congressional intent” with reconciliation funds, the general declined to explicitly answer and said he “will carry out the funding in accordance with the law” and “will strive to do my best.”

    One of the major efforts led by Allvin and former Air Force Secretary Frank Kendall was a sweeping organizational shift for great power competition, an influx of increased strategy and spending focused on countering China. Wilsbach did not commit to continuing these reoptimization efforts. He did acknowledge during questioning by Sens. Mazie Hirono, D-Hawaii, and Mark Kelly, D-Ariz., that China was a threat to national security and worth further investment from the committee. 

    Mirroring comments made by Air Force Secretary Troy Meink last month, Wilsbach stated in submitted written answers to lawmakers’ policy questions that both the homeland and the Pacific would be prioritized. 

    “Homeland Defense is our top priority. At the same time, our Service needs to be able to project power into critical regions to prevent wars when possible, or to win them if and when we must,” Wilsbach wrote in the document. “The Air Force must deliberately preserve our high-end readiness for the nation's most consequential challenges, such as that posed by China in the Western Pacific.”

    When asked outside of his hearing Thursday morning if he planned to support those past reoptimization efforts, Wilsbach said, “That’s outside of my lane,” and added that it is Meink’s decision to make. 

    “I’ve had some private conversations,” the general said, and said he wouldn’t be sharing details of those talks with reporters.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Over the past two months, threat actors have weaponized a critical authentication bypass flaw in the Service Finder Bookings WordPress plugin, enabling them to hijack any account on compromised sites.

    First disclosed on July 31, 2025, the vulnerability emerged after a bug bounty submission revealed that the plugin’s servicefinderswitchback function failed to validate a user-switch cookie before elevating privileges.

    Attackers quickly reverse-engineered the weakness, triggering mass exploitation campaigns that began on August 1 and intensified throughout September.

    During this period, the Wordfence Firewall blocked more than 13,800 exploit attempts across thousands of sites running affected versions.

    In its initial probing phase, adversaries sent specially crafted HTTP requests that included a malicious originaluserid cookie, bypassing authentication entirely.

    Wordfence analysts noted the sudden uptick in abnormal switchback requests within hours of public disclosure, prompting the rapid deployment of a firewall rule for all Wordfence Premium, Care, and Response customers.

    CVE IDAffected PluginVersions AffectedPatched VersionCVSS 3.1 ScoreAttack Vector
    CVE-2025-5947Service Finder Bookings≤ 6.06.19.8Authentication Bypass

    Sites using the free version received protection after a 30-day delay, leaving many installations exposed until mid-July.

    The impact of successful exploitation is catastrophic: an unauthenticated actor gains complete administrator privileges, allowing installation of backdoors, data exfiltration, or site defacement.

    With over 6,000 active installs of the vulnerable plugin, the threat landscape widened as scanning bots and scripted exploit kits began probing for Service Finder Bookings endpoints.

    Infection Mechanism

    A closer look at the exploit reveals that attackers target the servicefinderswitchback endpoint by sending a GET request to ?switchback=1 with the Cookie: originaluserid=<target_id>.

    The plugin code then invokes:-

    if ( isset( $_COOKIE['originaluserid'] ) ) {
        $originaluserid = intval( $_COOKIE['originaluserid'] );
        wp_set_current_user( $originaluserid );
        wp_set_auth_cookie( $originaluserid, true );
    }

    Because neither authentication nor nonce checks are performed, the attacker’s supplied user ID is accepted unconditionally, logging them in as that user—often the site administrator.

    This simple yet powerful bypass underscores the importance of rigorous input validation in session-handling routines.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Hackers Actively Exploiting WordPress Plugin Vulnerability to Gain Admin Access appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶