• SonicWall has released an urgent software update for its Secure Mobile Access (SMA) 100 Series appliances to remove a dangerous rootkit known as ‘OVERSTEP.’ This backdoor malware was discovered in older SMA firmware versions and can give attackers persistent access to affected devices. The new build, version 10.2.2.2-92sv, adds additional file checking to detect and […]

    The post SonicWall Issues Emergency Patch to Remove ‘OVERSTEP’ Rootkit Malware on SMA Devices appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • For China’s People’s Liberation Army, massive parades like the recent celebration of the 80th anniversary of victory in World War II are more than propaganda set pieces. Military leaders use them to show their Party superiors that the force is progressing towards its modernization goals, including being ready to fight jointly and to defeat any potential adversary—particularly “the strong adversary,” i.e., the United States. And as PLA texts attest, parades are opportunities to unveil new systems intended to deepen nuclear and conventional deterrence.

    The hours-long showcase on Sept. 3 offered glimpses of new weapons—especially missiles—and hints about about China’s progress on key military technologies. These are valuable because the PLA operates in an opaque manner, and because its equipment and weapons, with some notable exceptions, have seldom been tested on the battlefield. But analysts must proceed cautiously: the parade was at heart a carefully calibrated influence operation. As one U.S. military analyst recently noted, the military equipment that the PLA displayed “was exactly what they wanted the world and the U.S. military to see.”   

    So what should we make of five PLA missile systems that made their public debut on Sept. 3? Are they mere showpieces—“old wine in a new bottle,” as the Chinese idiom goes—or are they showstoppers that should give U.S. military planners pause? 

    DF-61 ICBM: Showpiece (mostly). Little is known about this massive, road-mobile, solid-fueled ballistic missile beyond its reported range of over 12,000 kilometers and alleged payload of up to ten multiple independently targetable reentry vehicles. But several analysts suspect it may be an incrementally updated version of the DF-41 road-mobile ICBM that appeared in the 2019 parade and is now operated by the PLA Rocket Force. The missiles are similar in design and use the same transporter-erector-launcher. Both systems are made by the China Academy of Launch Vehicle Technology under the China Aerospace Science and Technology Corporation, an enormous state-owned aerospace enterprise that is the country’s sole ICBM manufacturer

    In the parade, the DF-61 rolled among other strategic weapons, which further suggests that it is simply a better version of the nuclear DF-41. And yet: the possibility exists that its placement was deception. It is conceivable that the weapon is a new conventional ICBM—and a significant boost to the PLA’s long-range tactical striking power.

    DF-5C ICBM: Showpiece. Bringing up the rear of the parade’s missile column was the DF-5C, an upgraded variant of the four-decade-old DF-5, the PLA’s oldest active ICBM. The arrival of the C variant adds range and warheads to China’s array of liquid-fueled, silo-based missiles. But its technology is not new, having been first tested in 2017; and its predecessor DF-5B could also carry MIRVs to any target in the United States. 

    In the parade, the DF-5B followed the DF-31BJ, an improved version of the DF-31AG solid-fueled ICBM that first appeared in 2017. The prominence of these two silo-based missiles at the end of the line is a reminder that even as the PLA adds road-mobile ICBMs and works to consolidate a nuclear triad with better sea- and air-launched nuclear missiles, its expanding network of ICBM silos remains another key element of deterrence. 

    CJ-1000 long-range hypersonic cruise missile: Showstopper. The parade’s “cruise missile column” saw the debut of several advanced air, sea, and ground-launched cruise missiles. None is a bigger gamechanger than the Changjian-1000, which ups the PLARF’s precision-strike capabilities with engines that U.S. missiles still lack. 

    Unlike the PLARF’s current DF-17 hypersonic missile, which uses a boost glide system, the CJ-1000 and the YJ-19 missile (see below) are propelled by airbreathing scramjet engines, which makes the PLA just the second military, after Russia’s, to deploy scramjet hypersonic weapons. The U.S. Air Force’s effort to develop a hypersonic cruise missile, meanwhile, is delayed and over budget.

    The U.S. Army’s Training and Doctrine Command reports that the CJ-1000 can launch quickly and penetrate deeply against high-value land or sea targets. And although U.S. missile defense systems such as THAAD have received upgrades to better track and intercept hypersonic attacks, they will be challenged by the high maneuverability and long range of the CJ-1000, which can purportedly launch from Fujian in eastern China and hit Guam in 38 minutes. Xinhua agrees: the speedy, nimble, long-ranged CJ-1000 is a potential gamechanger that threatens U.S. bases in the western Pacific.

    YJ-19 hypersonic anti-ship missile: Showstopper. The parade’s anti-ship missile formation introduced four new types—three of which are likely hypersonic. Perhaps the most notable is the YJ-19, whose scramjet is reportedly capable of flying faster than Mach 10 out to around 1,440 kilometers. Its waverider configuration harnesses its own shockwaves to improve lift-drag ratio.

    If the capabilities are as advertised, the YJ-19 will greatly improve the ability of the PLA Navy’s surface ships and attack submarines to strike enemy warships within the first and even second island chains. Like the CJ-1000, it provides a capability that the U.S. does not currently have and raises the level of risk to U.S. forces responding to a contingency in our around Taiwan, the South China Sea, or the East China Sea.

    HQ-29 anti-ballistic missile and anti-satellite weapon: Showstopper. Among the several HQ-series surface-to-air missiles debuted in the parade’s air defense column, the standout was the Hongqi-29—and not just because it was the largest. 

    The HQ-29 is a follow-on to the HQ-19 high-altitude interceptor, which employs kinetic-kill technology akin to the U.S. THAAD system. It is road-mobile, unlike other long-range interceptors that are silo-based, allowing for more flexible deployments and optimization of launch position. The HQ-29 also provides the PLA with an interceptor that can hit incoming ICBMs in midcourse—or even low-earth orbit satellites. If and when it is fielded, it will improve China’s regional ballistic missile defense and anti-satellite warfare capabilities.  

    China clearly intended its Sept. 3 parade to convey its growing military strength and technological ambition, and it succeeded. The new and not-so-new missiles clearly show the PLA’s growing ability to project power and Beijing’s intention to fundamentally alter the region’s military balance. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Libraesva has released a security update to address a vulnerability in its Email Security Gateway (ESG) solution that it said has been exploited by state-sponsored threat actors. The vulnerability, tracked as CVE-2025-59689, carries a CVSS score of 6.1, indicating medium severity. “Libraesva ESG is affected by a command injection flaw that can be triggered by a malicious email containing a

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Darktrace’s latest investigation uncovered a novel campaign that blends traditional malware with modern DevOps technology. At the center of this operation lies a Python-based command-and-control (C2) framework hosted on GitHub CodeSpaces. The threat actors leverage a multi-stage Docker deployment initiated by a Python spreader, followed by a Go-based Remote Access Trojan (RAT) that implements a […]

    The post ShadowV2 Botnet Infects AWS Docker Containers to Launch DDoS Campaign appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA has released a comprehensive cybersecurity advisory detailing how threat actors successfully compromised a U.S. federal civilian executive branch agency’s network by exploiting CVE-2024-36401, a critical remote code execution vulnerability in GeoServer.

    The incident, which remained undetected for three weeks, highlights significant gaps in vulnerability management and incident response preparedness within federal agencies.

    GeoServer RCE Vulnerability (CVE-2024-36401)

    The attack commenced on July 11, 2024, when cyber threat actors exploited CVE-2024-36401 on a public-facing GeoServer instance to gain initial network access. 

    This critical vulnerability, disclosed on June 30, 2024, enables unauthenticated users to achieve remote code execution through “eval injection” attacks on affected GeoServer versions. 

    The vulnerability carries a CWE-95 classification for “Eval Injection” and was subsequently added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog on July 15, 2024.

    The threat actors demonstrated persistence by exploiting the same vulnerability on a second GeoServer (GeoServer 2) on July 24, 2024, despite the vulnerability being publicly disclosed 25 days earlier. 

    Between these initial compromises, the attackers conducted extensive reconnaissance using Burp Suite Burp Scanner to identify vulnerable systems and employed publicly available tools, including the fscan network scanner and linux-exploit-suggester2.pl, for comprehensive network enumeration.

    Following initial access, the threat actors established persistence through multiple techniques, including deployment of China Chopper web shells, creation of cron jobs for scheduled command execution, and attempts to escalate privileges using the publicly available dirtycow exploit targeting CVE-2016-5195. 

    Overview of Threat Actor Activity
    Overview of Threat Actor Activity

    The attackers also staged the RingQ defense evasion tool and utilized the Stowaway multi-level proxy tool to establish command and control communications over TCP ports 4441 and 50012.

    The compromise escalated as threat actors moved laterally from the initial GeoServer to a web server and subsequently to a SQL server, uploading web shells and scripts on each compromised system. 

    On the SQL server, they executed extensive discovery commands including whoami, systeminfo, tasklist, and netstat -ano to enumerate system information and network connections. 

    The attackers enabled cmdshell for remote code execution and utilized PowerShell and bitsadmin for payload downloads, demonstrating sophisticated living-off-the-land techniques.

    The incident remained undetected for three weeks until July 31, 2024, when the agency’s endpoint detection and response (EDR) tool identified a suspicious 1.txt file uploaded to the SQL server. 

    This detection delay occurred despite the EDR system generating an alert on July 15, 2024, when it detected the Stowaway tool on GeoServer 1, which went unreviewed by the security operations center. 

    The agency’s Web Server notably lacked endpoint protection entirely, creating additional blind spots in their security monitoring capabilities.

    Risk FactorsDetails
    Affected ProductsApache GeoServer 2.x (all releases before 2.26.5)
    ImpactRemote Code Execution via eval injection
    Exploit PrerequisitesPublicly accessible GeoServer instance; no auth
    CVSS 3.1 Score9.8 (Critical)

    CISA’s analysis revealed three critical lessons learned from this incident: vulnerabilities were not promptly remediated despite public disclosure and KEV catalog inclusion, the agency’s incident response plan lacked procedures for engaging third-party assistance and granting necessary access to security tools, and EDR alerts were not continuously monitored across all systems. 

    The advisory emphasizes that while July 24, 2024, fell within the KEV-required patching window, organizations should address known exploited vulnerabilities immediately as part of comprehensive vulnerability management practices.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post CISA Details That Hackers Gained Access to a U.S. Federal Agency Network Via GeoServer RCE Vulnerability appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers at Zscaler ThreatLabz have identified a sophisticated new malware strain dubbed YiBackdoor, first detected in June 2025. This emerging threat represents a significant evolution in backdoor technology, sharing substantial code similarities with established malware families IcedID and Latrodectus. The discovery highlighted the continuous adaptation of cybercriminal tools, as YiBackdoor demonstrates capabilities that enable […]

    The post New “YiBackdoor” Malware Lets Hackers Run Commands and Steal Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Jaguar Land Rover (JLR) has announced a further delay to the reopening of its production lines following a sophisticated cyber attack. The pause in manufacturing has been extended until Wednesday, 1 October 2025, to allow the investigation to progress and to ensure a secure return to operations. Overview of Cyber Attack Earlier this week, JLR […]

    The post Jaguar Land Rover Factory Reopening Delayed After Cyber Attack appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google has released an urgent security update for its Chrome browser, addressing three high-severity vulnerabilities that could allow attackers to leak sensitive information and cause system instability. The latest Chrome version 140.0.7339.207/.208 for Windows and Mac, and 140.0.7339.207 for Linux, patches critical flaws in the V8 JavaScript engine that powers the browser’s web content processing. […]

    The post Chrome High-severity Flaws Expose Sensitive Data, Trigger System Crashes appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google has issued an urgent security update for its Chrome web browser to address three high-severity vulnerabilities that could allow attackers to access sensitive information or cause the system to crash.

    The company is advising users to update their browsers immediately to mitigate the potential risks associated with these flaws.

    The latest patch brings the Chrome Stable channel to version 140.0.7339.207/.208 for Windows and Mac, and 140.0.7339.207 for Linux. The update will be distributed automatically over the coming days and weeks, but users can manually trigger the update to ensure they are protected without delay.

    All three high-severity vulnerabilities discovered reside within the V8 JavaScript and WebAssembly engine, a core component of Chrome that is responsible for executing program code.

    The first flaw, tracked as CVE-2025-10890, is a side-channel information leakage vulnerability. This type of weakness could potentially allow a remote attacker who has convinced a user to visit a malicious website to read sensitive data from the browser’s memory, bypassing security measures designed to keep information isolated. External security researcher Mate Marjanović reported this vulnerability.

    The other two vulnerabilities, CVE-2025-10891 and CVE-2025-10892, are both described as integer overflows within the V8 engine.

    These were discovered internally by Google’s Big Sleep research team. An integer overflow is a common software bug that occurs when a numerical value is too large for the memory space allocated to it, causing it to “wrap around” and result in unexpected behavior.

    In a browser context, attackers can often exploit such flaws to cause a denial-of-service condition by crashing the renderer process or to execute arbitrary code on the affected system.

    Attackers Could Exploit the Vulnerabilities

    A successful exploit of these vulnerabilities would typically require an attacker to lure a victim into visiting a specially crafted, malicious webpage.

    For CVE-2025-10890, the malicious code on the page could trigger the side-channel flaw, allowing the attacker to infer data from other websites or processes running on the user’s machine.

    The two integer overflow flaws, if exploited, could lead to abrupt browser crashes. While Google’s advisory does not confirm it, integer overflows can sometimes be chained with other exploits to gain full control over a compromised system, making them a serious threat.

    In line with its standard security policy, Google is currently restricting access to the technical details and proof-of-concept exploits for these bugs.

    This measure is intended to prevent widespread attacks by giving the majority of users sufficient time to install the security patch. The restrictions will be lifted once the update has been broadly deployed.

    Google strongly recommends that all Chrome users ensure their browser is updated to the latest version to defend against potential exploitation.

    To check for and install the update, users can navigate to the Chrome menu, select “Help,” and then click on “About Google Chrome.” The browser will automatically scan for the latest version and prompt the user to relaunch to complete the installation.

    Google also extended its gratitude to the security researchers who contributed to identifying and reporting these vulnerabilities, highlighting the collaborative effort required to maintain browser security.

    The company noted that many of its security bugs are detected using advanced testing tools like AddressSanitizer, MemorySanitizer, and various fuzzing libraries, which help identify and fix flaws before they can reach the stable channel.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Chrome High-severity Vulnerabilities Let Attackers Access Sensitive Data and Crash System appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity professionals are facing an unprecedented acceleration in threat actor capabilities as the average breakout time—the period from initial access to lateral movement—has plummeted to a mere 18 minutes during the June-August 2025 reporting period.

    This alarming statistic represents a dramatic reduction from previous timeframes, with the fastest recorded incident clocking in at just six minutes when Akira ransomware operators compromised a SonicWall VPN and initiated lateral movement in record time.

    The speed at which modern threat actors operate leaves defenders with extremely narrow windows for detection and response.

    ReliaQuest analysts have identified that this acceleration stems from sophisticated automation techniques and the weaponization of legitimate system tools that evade traditional security controls.

    The convergence of drive-by compromises, USB-based malware distribution, and advanced evasion techniques creates a perfect storm for rapid network infiltration and compromise.

    Drive-by compromises continue to dominate initial access vectors, accounting for 34% of incidents during this reporting period.

    However, ReliaQuest researchers noted a concerning surge in USB-based attacks linked to Gamarue malware, which exploits the implicit trust organizations place in removable media devices.

    The malware’s sophisticated approach involves hiding malicious Dynamic Link Libraries so effectively that most users remain unaware of infection, while malicious LNK files disguise themselves as legitimate files already present on USB devices.

    Organizations listed on ransomware data-leak sites, by sector, during this reporting period vs. the last reporting period (Source – Reliaquest)

    The emergence of Oyster malware as the dominant threat has fundamentally altered the cybersecurity landscape.

    Through sophisticated search engine optimization poisoning campaigns powered by artificial intelligence and automation, Oyster operators have scaled their operations to target IT administrators specifically—recognizing that compromising these high-value accounts provides golden ticket access to entire organizational infrastructures.

    The malware leverages malvertising to distribute trojanized versions of legitimate IT tools like PuTTY through convincing fake websites such as puttysystems[.]com.

    Advanced Evasion Through System Binary Exploitation

    Oyster’s technical sophistication extends far beyond traditional malware capabilities through its strategic abuse of trusted Windows system binaries, particularly rundll32.exe.

    This legitimate Windows component has become the cornerstone of the malware’s evasion strategy, enabling it to execute malicious DLLs while bypassing file-based detection mechanisms that security solutions rely upon.

    The malware deploys a specific DLL named “twain_96.dll” through carefully orchestrated scheduled tasks that mimic legitimate system activity.

    This approach represents a fundamental shift in attack methodology, as it exploits the implicit trust that security systems place in signed system binaries.

    The scheduled tasks are designed to appear as routine maintenance operations, making detection through behavioral analysis significantly more challenging.

    rundll32.exe twain_96.dll,DllRegisterServer

    The persistence mechanism employed by Oyster demonstrates remarkable technical sophistication. Rather than relying on traditional registry modifications or startup folder entries that modern endpoint detection systems actively monitor, the malware establishes scheduled tasks that execute at seemingly random intervals.

    These tasks invoke rundll32.exe with specific parameters that load the malicious payload while maintaining the appearance of legitimate system processes.

    ReliaQuest analysts identified that Oyster alone accounts for 48% of incidents involving the “Match Legitimate Name or Location” sub-technique, highlighting how the malware’s naming conventions and file placement strategies successfully deceive both automated security tools and human analysts.

    The malware’s ability to masquerade as trusted system files represents a critical evolution in evasion techniques that organizations must address through enhanced behavioral monitoring and anomaly detection capabilities.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Threat Actors Breaking to Enterprise Infrastructure Within 18 Minutes From Initial Access appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶