• The Cybersecurity and Infrastructure Security Agency (CISA) yesterday issued a high-severity alert (ICSA-25-245-03) regarding a critical vulnerability in SunPower’s PVS6 solar inverter series that allows attackers on adjacent networks to gain complete control of the device. Rated 9.4 out of 10 on the CVSS v4 scale, the vulnerability stems from hard-coded credentials in the Bluetooth […]

    The post CISA Alerts on Critical SunPower Vulnerability Allowing Full Device Takeover appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA has issued an urgent advisory concerning a newly disclosed zero-day vulnerability in Meta Platforms’ WhatsApp messaging service (CVE-2025-55177). 

    This flaw, categorized under CWE-863: Incorrect Authorization, allows an unauthorized actor to manipulate linked device synchronization messages and force a target device to fetch and process content from an attacker-controlled URL. 

    Key Takeaways
    1. CVE-2025-55177 exploits a WhatsApp device-sync auth flaw to fetch malicious URLs.
    2. CWE-863 error enables RCE and has surfaced in phishing.
    3. CISA mandates the Sept 2 patch or suspending WhatsApp.

    Organizations and individual users are strongly urged to apply vendor-supplied mitigations by September 23, 2025, or to discontinue use until secure patches are available.

    WhatsApp Authorization Vulnerability (CVE-2025-55177)

    CVE-2025-55177 arises from an incomplete authorization check in WhatsApp’s handling of linked device synchronization messages. 

    When a user links their WhatsApp client on a new device, synchronization messages propagate chat histories and media over multiple endpoints. 

    Due to the improper verification of message source and integrity, an unrelated user can craft a malicious synchronization payload referencing an arbitrary URL. The vulnerable client will:

    • Parse the synchronization message without verifying the sender’s authorization token.
    • Initiate a GET request to the attacker-controlled URL to retrieve additional payload data.
    • Execute or display content such as a JavaScript-powered web page in the context of the WhatsApp client.

    This chain of events effectively enables remote code execution (RCE) or content spoofing, which could be leveraged to drop payloads ranging from credential-stealing scripts to ransomware. 

    While it remains unconfirmed whether CVE-2025-55177 has been integrated into active ransomware campaigns, its exploitation in targeted phishing operations has already been observed.

    Risk FactorsDetails
    Affected ProductsWhatsApp messaging service
    ImpactRemote code execution
    Exploit PrerequisitesThe attacker must send a crafted linked-device synchronization message to the target.
    The victim’s device must have an active linked-device feature enabled
    CVSS 3.1 Score5.4 (MEDIUM)

    Mitigations

    CISA’s advisory instructs all entities using WhatsApp, particularly those in critical infrastructure sectors, to implement the following steps immediately:

    Apply the patch released on September 2, 2025, by Meta Platforms as outlined in their Security Advisory.

    Enforce the vendor’s configuration guidance, ensuring that linked-device synchronization messages are permitted only from authenticated endpoints.

    Follow the Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive (BOD) 22-01 requirements for cloud service security, including multi-factor authentication and robust logging of all synchronization events.

    CISA advises discontinuing WhatsApp usage until a secure version is deployed. Organizations must also monitor network traffic for unusual outbound HTTP requests originating from WhatsApp clients, which may indicate exploitation attempts.

    As a precaution, security teams should validate patch installation and verify that the fixed version correctly rejects unauthorized synchronization payloads.

    Find this Story Interesting! Follow us on Google NewsLinkedIn, and X to Get More Instant Updates.

    The post CISA Warns of WhatsApp 0-Day Vulnerability Exploited in Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In a landmark settlement announced on September 2, 2025, The Walt Disney Company has agreed to pay a $10 million civil penalty to resolve allegations by the United States Department of Justice that its subsidiaries violated federal law by collecting personal data from children without parental consent. The suit, filed as Case No. 2:25-cv-08223 in […]

    The post Disney to Pay $10 Million Over Children’s Data Privacy Violations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cloudflare on Tuesday said it automatically mitigated a record-setting volumetric distributed denial-of-service (DDoS) attack that peaked at 11.5 terabits per second (Tbps). “Over the past few weeks, we’ve autonomously blocked hundreds of hyper-volumetric DDoS attacks, with the largest reaching peaks of 5.1 Bpps and 11.5 Tbps,” the web infrastructure and security company said in a post on X. “

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A proof-of-concept exploit for CVE-2025-53772, a critical remote code execution vulnerability in Microsoft’s IIS Web Deploy (msdeploy) tool, was published this week, raising urgent alarms across the .NET and DevOps communities. 

    The flaw resides in the unsafe deserialization of HTTP header contents in both the msdeployagentservice and msdeploy.axd endpoints, enabling authenticated attackers to execute arbitrary code on target servers.

    Key Takeaways
    1. IIS Web Deploy deserialization RCE (CVSS 8.8)
    2. PoC uses MSDeploy.SyncOptions header to spawn commands
    3. Mitigate by disabling agent, tightening access, and patching

    Proof-of-Concept for IIS WebDeploy RCE Flaw

    At the heart of CVE-2025-53772 is a custom deserialization routine that neglects robust input validation. 

    Hawktrace reports that the vulnerable code path processes a Base64-encoded, GZip-compressed payload taken from the MSDeploy.SyncOptions HTTP header.

    The sequence Base64 decoding followed by GZip decompression and BinaryFormatter.Deserialize() fails to enforce type whitelisting, allowing malicious payloads to instantiate dangerous objects. 

    In particular, crafting a SortedSet<string> object backed by a manipulated MulticastDelegate invocation list triggers Process the start, leading to remote code execution.

    The publicly available PoC demonstrates how an attacker can abuse .NET’s serialization mechanics:

    Public PoC Exploit Emerges for IIS WebDeploy

    Sending this payload in an HTTP POST to /msdeploy.axd results in calc.exe launching on the server.

    Risk FactorsDetails
    Affected ProductsMicrosoft Web Deploy (msdeployagentservice & msdeploy.axd)
    ImpactRemote Code Execution (RCE)
    Exploit PrerequisitesAuthenticated Web Deploy user; network access to deployment endpoint; ability to send crafted HTTP headers
    CVSS 3.1 Score8.8 (High)

    Mitigation 

    Microsoft has assigned a CVSS score of 8.8 for CVE-2025-53772. Immediate mitigation steps include disabling the Web Deploy Agent Service (MsDepSvc), enforcing strict network ACLs on the msdeploy.axd endpoint, and applying inbound filtering to block unexpected MSDeploy.SyncOptions headers. 

    Long-term remediation requires replacing BinaryFormatter with a secure serializer (e.g., DataContractSerializer with explicit type contracts) and validating all header inputs before deserialization.

    As PoC exploits circulate, organizations that leverage IIS Web Deploy must prioritize patching and hardening to prevent authenticated attackers from exploiting this critical RCE vector.

    Find this Story Interesting! Follow us on Google NewsLinkedIn, and X to Get More Instant Updates.

    The post PoC Exploit Released for IIS WebDeploy Remote Code Execution Vulnerability appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google has released a critical Android Security Bulletin for September 2025, addressing multiple high-severity vulnerabilities that are currently being actively exploited in the wild. The security patch level 2025-09-05 or later is required to protect Android devices from these serious threats. The security bulletin reveals that two CVEs are under limited, targeted exploitation, making this update particularly urgent for Android […]

    The post Android Issues Security Update to Patch Actively Exploited 0-Day Flaws appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A stealthy new malware loader dubbed TinyLoader has begun proliferating across Windows environments, exploiting network shares and deceptive shortcut files to compromise systems worldwide.

    First detected in late August 2025, TinyLoader installs multiple secondary payloads—most notably RedLine Stealer and DCRat—transforming infected machines into fully weaponized platforms for credential theft, remote access, and cryptocurrency hijacking.

    Analysts have observed rapid escalation in the loader’s deployment, with infections traced to corporate file shares, removable media, and social engineering tactics that entice unsuspecting users to execute malicious binaries.

    While malware loaders are not a novel threat, TinyLoader distinguishes itself through a combination of aggressive lateral movement and sophisticated persistence mechanisms.

    Initial access is frequently achieved via network shares: the loader scans for open SMB resources, replicates itself as an innocuous “Update.exe” file, and updates directory timestamps to avoid detection.

    Once executed, it immediately reaches out to predefined command-and-control (C2) servers to download additional modules.

    Hunt.io researchers identified early C2 infrastructure hosted at IP addresses 176.46.152.47 and 176.46.152.46 in Riga, Latvia, with further nodes in the UK and Netherlands, all operated under a single hosting provider to streamline deployment.

    Hunt.io analysts noted that TinyLoader’s interface mirrors modern malware-as-a-service panels, offering threat actors an intuitive web portal for campaign management.

    Examination of the loader’s payload retrieval sequence revealed six hard-coded URLs pointing to malicious binaries—bot.exe and zx.exe among them—which are saved to the Windows temporary directory and executed without user interaction.

    This modular approach allows attackers to rotate payloads and pivot to new tools such as cryptocurrency clipper modules or remote access trojans with minimal redevelopment effort.

    Following the outbreak of infections, security teams scrambled to uncover detection signatures.

    TinyLoader command-and-control login panel (Source – Hunt.io)

    TinyLoader’s login panel carries a consistent HTML title tag:-

    <title>Login - TinyLoader</title>

    This string became a critical indicator for web crawler searches, enabling defenders to enumerate additional C2 panels and preemptively block them.

    Hunt.io scan results (Source – Hunt.io)

    The Hunt.io scan results for suspicious IP address 176.46.152.47 illustrates the initial discovery that triggered further infrastructure mapping.

    Infection Mechanism: Network Share Propagation and Fake Shortcuts

    TinyLoader’s primary infection vector leverages both network file sharing and social engineering via fake Windows shortcuts.

    Upon gaining administrative privileges, the loader injects itself into the Windows registry to hijack .txt file associations:-

    Windows Registry Editor Version 5.00
    [HKEY_CLASSES_ROOT\txtfile\shell\open\command]
    @="\"%SystemRoot%\\System32\\cmd[.]exe\" /c start \"\" \"C:\\Windows\\System32\\Update.exe\" \"%1\""

    This modification ensures that any attempt to open a text file silently launches TinyLoader first, before displaying the legitimate document.

    Concurrently, the malware scans writable network shares, copying both “Update.exe” and malicious shortcut files named “Documents Backup.lnk.”

    When these shortcuts are double-clicked, they execute TinyLoader while masquerading as a user-friendly backup utility.

    Fake desktop shortcut used for social engineering (Source – Hunt.io)

    While the above mentioned fake desktop shortcut used for social engineering, exemplifies this tactic.

    The loader also targets removable media: every USB insertion triggers replication of TinyLoader under enticing names like “Photo.jpg.exe.”

    An accompanying autorun.inf file guarantees execution on the next host, perpetuating the infection cycle.

    Together, these techniques create a resilient propagation mechanism that spans both local and enterprise networks, making TinyLoader exceptionally difficult to eradicate once established.

    Defenders are urged to monitor registry changes affecting file associations, deploy policies restricting executable creation on network shares, and inspect shortcut files for unusual targets.

    By combining signature-based detection of the “Login – TinyLoader” panel with behavioral monitoring of autorun activity, security teams can mitigate the rapid spread of this emerging threat.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post New TinyLoader Malware Attacking Windows Users Via Network Shares and Fake Shortcuts Files appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Ukraine has reached a critical milestone, the country’s Ministry of Defense announced Monday: more than one million drones delivered to military units since January, with two million expected by the end of the year. 

    The achievement provides a vivid illustration of a counterintuitive phenomenon: increasing the speed of innovation and deployment of new technologies may not result in any increase in battlefield gains.

    “Those one-way attack drones are not going to gain air superiority, and they don’t have air superiority, and that’s really one of the key attributes of the conflict in Russia-Ukraine, is no one does,” Gen. Alexus Grynkewich, commander of  U.S. European Command, and Supreme Allied Commander Europe, said last week at an NDIA event in Washington, D.C. And, he said, maintaining U.S. and NATO air superiority in an environment where even small militaries can deploy strategies to rapidly erode U.S. advantage remains a “core mission.”

    Ukraine had help reaching its goal. Among the million-plus drones are U.S.-made Switchblade and Ghost drones, as well as unmanned platforms paid for with $2.5 billion donated by nongovernmental groups and citizen donations since 2024. 

    But Ukraine has also radically reformed contracting procedures and opened direct web exchanges, allowing frontline commanders to source drones directly from manufacturers. The Ukrainian government says commanders can now order and receive weapons in as little as five days.

    These strategies have become a model for converting a 20th-century military into one that can effectively fight much larger and better-financed adversaries. The Pentagon is now taking similar steps after years of struggling to produce large numbers of cheap, highly autonomous drones that can also be rapidly modified to meet changing threats.

    Emil Michael, the undersecretary of defense for research and development, speaking at the same event, said the new U.S. approach “mimics what the Ukrainians have done. They push down the innovation to a very small unit level. They’ve competed them on which drones work better. Then they give more financing to the ones that work better. So that’s their model. Our model is going to be: bring it down to the unit level, reduce the barriers, provide broad training grounds.”

    Several Defense Department initiatives to accelerate the development and proliferation of drones are also reaching new milestones, and the department anticipates that development will continue to get faster, officials said.

    Col. Glenn McCartan, the Defense Innovation Unit’s embed to U.S. European Command,  said DIU, working with industry, has finished prototyping its Artemis drones, a process that began in January after the down-selection of competitors. That timeline may seem long compared with Ukraine’s drone development, but is much faster than traditional U.S. procurement. 

    More importantly, McCartan said, DIU has helped build open communication lines between drone makers and commanders, allowing for small, fast buys. This includes commanders in Europe who are working to build up large drone and other weapons stockpiles on NATO’s border with Russia, an effort called the Eastern Flank Deterrence Line

    In April, Ukraine’s former commander in chief, Gen. Valeriy Zaluzhny, observed that modern victory now depends on “the ability to outpace the enemy in technological development.” The observation raises a larger question: outpace to where?

    Ukraine’s fast-delievered, million-plus drone force exists not just because of direct builder-to-soldier business relationships, but also because of broader trends in information-technology democratization. Digital tech has become exponentially cheaper, more powerful, and more available. It is the same trend that created the modern IT-led digital economy that displaced last century’s enterprises, which focused on control of physical assets. 

    But Ukraine’s “static front line,” as U.S. Army War College professor Frank Sobchak called it in August, also shows that rapid technology development does not necessarily build advantage over a larger, well-resourced adversary such as China or Russia. It simply erodes an opponent’s relative advantage. The result is a new type of conflict: more nimble operations and far faster invention and deployment of new weapons, but slower decisive wins.

    Grynkewich said U.S. air dominance will have to come from a mix of more capable next-generation platforms, fighters and bombers—manned and unmanned—alongside cheap drones.

    But the democratization that allowed Ukraine to build a massive drone force in just months does not lend itself to the construction of highly complex fighters and bombers, or other systems apart from consumer electronics, Michael acknowledged. 

    “With a drone, you can go from start to prototype in 18 months. You can’t do that for an F-35, right? You can’t have a startup just say, ‘Here’s an airplane.’” 

    In other words, fighter jets remain necessary, but technology trends are rendering them obsolete more quickly, so the U.S. advantage in air dominance is dissolving more rapidly—and coming at higher cost.

    For Michael, the key to building new U.S. dominance is continued investment in digital infrastructure away from the battlefield. For example, he said he is looking for ways to deploy artificial intelligence across the entire Defense Department.

    Defense One asked Michael about a recent MIT analysis and comments from AI technology leaders suggesting a potential drop in funding to the sector.

    “We had the same thing with the internet. We had the same feeling with mobile phones. I think we’re going through the same cycle with AI right now, where we’re not sure where it ends. My instinct says it ends the same way the internet and mobile phones did. AI becomes a critical part of what we do every day. The infrastructure around it is much more significant than you think it’ll be, and the advantages you can get from it are much greater than you could possibly imagine sitting right at the beginning.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The rise of hybrid workforces and multi-cloud environments has made Identity & Access Management (IAM) more critical than ever. In 2025, a robust IAM solution is the cornerstone of a Zero Trust security model, where no user, device, or application is trusted by default. The best IAM tools go beyond simple authentication, offering a comprehensive […]

    The post Top 10 Best Identity and Access Management (IAM) Tools in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A newly disclosed remote code execution (RCE) vulnerability in Microsoft’s IIS Web Deploy toolchain has captured industry attention after the release of a public proof-of-concept. Tracked as CVE-2025-53772, this flaw resides in the unsafe deserialization logic of the msdeployagentservice and msdeploy.axd endpoints, allowing authenticated attackers to run arbitrary code on vulnerable web servers. IIS Web […]

    The post IIS WebDeploy RCE Vulnerability Gets Public PoC appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶