1010.cx – Page 69

New Phishing Technique Targets Users via Basic Auth URLs

10/16/2025

·

cyber security, Cyber Security News, Phishing

Netcraft recently uncovered a suspicious URL targeting GMO Aozora Bank, a Japanese financial institution. The URL leveraged a legacy web technique—Basic Authentication URL formatting—to visually impersonate the bank and deceive customers. This discovery prompted a broader review of phishing activity that still relies on this old but effective technique, exposing how threat actors can reuse […]

The post New Phishing Technique Targets Users via Basic Auth URLs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Windows BitLocker Flaws Allow Attackers to Bypass Encryption Protection

10/16/2025

·

CVE/vulnerability, cyber security, Cyber Security News, vulnerability, Windows

Two newly disclosed vulnerabilities in Microsoft’s BitLocker drive encryption feature could allow attackers to bypass encryption safeguards on Windows systems. Tracked as CVE-2025-55333 and CVE-2025-55338, these flaws involve incomplete comparison logic and configuration weaknesses that may let a local, low-privileged user undermine BitLocker’s protection. BitLocker is designed to protect data at rest by encrypting entire […]

The post Windows BitLocker Flaws Allow Attackers to Bypass Encryption Protection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
CISA Alerts on Adobe Experience Manager Flaw Exploited for Code Execution

10/16/2025

·

CVE/vulnerability, cyber security, Cyber Security News, vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Adobe Experience Manager Forms vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, warning that the flaw is being actively exploited in the wild. The security issue, tracked as CVE-2025-54253, affects Adobe Experience Manager Forms in JEE and allows attackers to execute arbitrary code on vulnerable […]

The post CISA Alerts on Adobe Experience Manager Flaw Exploited for Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
ThreatsDay Bulletin: $15B Crypto Bust, Satellite Spying, Billion-Dollar Smishing, Android RATs & More

10/16/2025

·

The online world is changing fast. Every week, new scams, hacks, and tricks show how easy it’s become to turn everyday technology into a weapon. Tools made to help us work, connect, and stay safe are now being used to steal, spy, and deceive. Hackers don’t always break systems anymore — they use them. They hide inside trusted apps, copy real websites, and trick people into giving up control

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Critical Samba RCE Vulnerability Enables Arbitrary Code Execution

10/16/2025

·

cyber security, Cyber Security News, vulnerability

Samba has disclosed a severe remote code execution (RCE) flaw that could allow attackers to hijack Active Directory domain controllers.

Tracked as CVE-2025-10230, the vulnerability stems from improper validation in the Windows Internet Name Service (WINS) hook mechanism, earning a perfect CVSS 3.1 score of 10.0 for its ease of exploitation and devastating potential impact.

Samba, the open-source implementation of the SMB/CIFS networking protocol widely used in Linux and Unix environments to mimic Windows file sharing and authentication, has long been a cornerstone for cross-platform enterprise networks.

However, this flaw exposes organizations relying on it as an Active Directory Domain Controller (AD DC) to unauthenticated attacks.

Discovered by security researcher Igor Morgenstern of Aisle Research, the issue affects all Samba versions since 4.0 when specific configurations are enabled, namely, WINS support and a custom ‘wins hook’ script in the smb.conf file.

Samba RCE Vulnerability

WINS, a deprecated Microsoft protocol from the pre-DNS era, resolves NetBIOS names in legacy Windows networks.

By default, WINS support is disabled in Samba, but when activated on an AD DC alongside the ‘wins hook’ parameter, which triggers an external script on name changes, the system becomes a sitting duck.

Attackers can send crafted WINS name registration requests containing shell metacharacters within the 15-character NetBIOS limit.

These inject arbitrary commands into the hook script, executed via a shell without any authentication or user interaction required.

The vulnerability’s scope is narrow but perilous: it only impacts Samba in AD DC mode (roles like ‘domain controller’ or ‘active directory domain controller’).

Standalone or member servers, which use a different WINS implementation, remain unaffected. In practice, this could let remote threat actors on the network pivot to full system compromise, exfiltrating sensitive data, deploying ransomware, or escalating privileges in hybrid Windows-Linux setups common in enterprises.

Mitigations

Samba maintainers acted swiftly, releasing patches to their security portal and issuing updated versions: 4.23.2, 4.22.5, and 4.21.9.

Administrators should prioritize upgrades, especially in environments with legacy WINS dependencies.

As a workaround, disable the ‘wins hook’ parameter entirely or set ‘wins support = no’ in smb.conf Samba’s default configuration already avoids this risky combo, making most setups safe out of the box.

Experts urge a broader review: WINS is obsolete, and its use on modern domain controllers is rare and inadvisable. Even post-patch, admins might disable hooks altogether, as future Samba releases could drop support.

With attack surfaces expanding in hybrid clouds, this incident underscores the need to audit and phase out antiquated protocols before they become entry points for nation-state actors or cybercriminals.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Critical Samba RCE Vulnerability Enables Arbitrary Code Execution appeared first on Cyber Security News.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
PhantomVAI Loader Launches Global Campaign to Distribute AsyncRAT, XWorm, FormBook, and DCRat

10/16/2025

·

cyber security, Cyber Security News, PhantomVAI

PhantomVAI Loader, a newly renamed multi-stage .NET loader tracked by Unit 42, is being used in widespread phishing campaigns to deliver a variety of information-stealing malware families. Initially identified as Katz Stealer Loader for its role in deploying the Katz Stealer infostealer, this loader now supports AsyncRAT, XWorm, FormBook and DCRat payloads through an evasive […]

The post PhantomVAI Loader Launches Global Campaign to Distribute AsyncRAT, XWorm, FormBook, and DCRat appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
CISA Warns Of Adobe Experience Manager Forms 0-Day Vulnerability Exploited In Attacks

10/16/2025

·

cyber security, Cyber Security News, vulnerability, Vulnerability News

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding a severe code execution vulnerability in Adobe Experience Manager Forms, urging organizations to patch immediately.

Tracked as CVE-2025-54253, this flaw affects the Java Enterprise Edition (JEE) version of the software and enables attackers to execute arbitrary code on vulnerable systems.

First disclosed by Adobe in early October 2025, the vulnerability has already been exploited in the wild, according to CISA’s Known Exploited Vulnerabilities Catalog.

Adobe Experience Manager Forms is a popular platform for creating and managing digital forms in enterprise environments, often used by businesses for customer interactions and document processing.

The unspecified nature of the vulnerability rated with a CVSS score of 9.8 out of 10 makes it particularly dangerous, as it requires no user interaction or authentication to trigger.

Attackers can leverage it to gain full control over affected servers, potentially leading to data theft, ransomware deployment, or further network compromise.

Exploitation and Real-World Impact

Reports indicate that threat actors have begun weaponizing CVE-2025-54253 in targeted attacks, though it’s unclear if ransomware groups are involved at this stage.

Security researchers from firms like Mandiant have observed exploitation attempts against unpatched instances hosted in cloud environments, where misconfigurations amplify the risk.

One notable incident involved a mid-sized financial services firm in Europe, where attackers used the flaw to deploy malware, resulting in a temporary service outage and data exfiltration.

CISA added the CVE to its catalog on October 15, 2025, emphasizing that federal agencies must apply mitigations by November 14 or discontinue use of the product.

This aligns with Binding Operational Directive 22-01, which mandates rapid response to actively exploited flaws in federal systems. Private sector organizations are also at high risk, especially those relying on Adobe’s suite for web content management.

Adobe has released patches for affected versions, including AEM Forms 6.5.13 and earlier. Users should apply updates promptly, enable multi-factor authentication, and segment networks to limit lateral movement.

For cloud deployments, following BOD 22-01 guidance is essential, including regular vulnerability scanning. This incident underscores the ongoing challenges in supply chain security, as Adobe products are integral to many digital ecosystems.

With exploitation confirmed, experts warn of potential escalation if patches lag. Organizations should prioritize auditing their AEM deployments to stay ahead of evolving threats.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post CISA Warns Of Adobe Experience Manager Forms 0-Day Vulnerability Exploited In Attacks appeared first on Cyber Security News.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Malicious Ivanti VPN Client Sites in Google Search Deliver Malware — Users Warned

10/16/2025

·

cyber security, Cyber Security News, Malware, VPN

Cybersecurity researchers at Zscaler have uncovered a sophisticated malware campaign that exploits search engine optimization (SEO) poisoning to distribute a trojanized version of the Ivanti Pulse Secure VPN client, targeting unsuspecting users seeking legitimate software downloads. The Zscaler Threat Hunting team recently detected a surge in malicious activity leveraging SEO manipulation, primarily targeting Bing search […]

The post Malicious Ivanti VPN Client Sites in Google Search Deliver Malware — Users Warned appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Cisco SNMP Vulnerability Actively Exploited to Install Linux Rootkits

10/16/2025

·

Cyber Security News

Cybersecurity researchers at Trend Micro have discovered an active attack campaign dubbed “Operation Zero Disco” that exploits a critical vulnerability in Cisco’s Simple Network Management Protocol (SNMP) implementation. The vulnerability, tracked as CVE-2025-20352, allows threat actors to execute remote code and deploy sophisticated Linux rootkits on vulnerable network devices. The campaign primarily targets older Cisco […]

The post Cisco SNMP Vulnerability Actively Exploited to Install Linux Rootkits appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
NightMARE: A Python Library for Advanced Malware Analysis and Threat Intelligence Extraction

10/16/2025

·

cyber security, Cyber Security News, Malware, Python

Elastic Security Labs has officially released nightMARE version 0.16, a comprehensive Python library designed to streamline malware analysis and reverse engineering workflows. The open-source tool consolidates multiple analysis capabilities into a single framework, enabling security researchers to extract configuration data and intelligence indicators from widespread malware families more efficiently. The development of nightMARE addresses a […]

The post NightMARE: A Python Library for Advanced Malware Analysis and Threat Intelligence Extraction appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

Samba RCE Vulnerability

Mitigations

Exploitation and Real-World Impact