Posts of last few hours

Cisco has warned that attackers are actively exploiting a zero-day flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. An unauthenticated remote attacker can use it to write arbitrary files and run commands as root on the underlying operating system. The advisory, cisco-sa-esa-afw-zqYJkjxp, says Cisco PSIRT learned of active exploitation in […]

The post Cisco Warns of Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Palo Alto Networks has warned that attackers are exploiting a high-severity remote code execution flaw in the PAN-OS management interface. Tracked as CVE-2026-0322, the bug lets an authenticated attacker with network access run arbitrary code with root privileges on the firewall. PAN-OS zero-day vulnerability The flaw is a code injection weakness (CWE-94, CAPEC-242) in the […]

The post Palo Alto Warns of PAN-OS 0-day Flaw Actively Exploited in Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Citizen Lab has confirmed the first public case of zero-click mercenary spyware delivered through targeted online ads. It calls the technique “AdFection”. The attack hit devices at Al Jazeera with Candiru spyware, and the ads were bought by an Israeli ad-tech firm called Discover-Tech. zero-click spyware attacks Online ads are sold in real-time auctions that […]

The post Hackers Use Online Ads to Infect Devices With Spyware Without a Single Click appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Citrix has disclosed four XenServer vulnerabilities, including three that could let a malicious user with elevated rights inside a virtual machine compromise or crash the underlying host. Citrix published the high-severity bulletin CTX697170 on October 13, 2026, covering XenServer 8.4 and XenServer 9. Citrix lists the advisory in its XenServer security bulletin archive. The host-impacting […]

The post Citrix XenServer Vulnerabilities Could Allow Malicious VM Users to Compromise Host Systems appeared first on Cyber Security News.

Hackers are using ClickFix tricks to install malware loaders and Python tunnels on Windows systems, creating access that could support ransomware attacks. A late September incident shows how a user running a command can start an infection chain built around trusted Microsoft programs, hidden code, and encrypted network traffic. The attack was stopped before ransomware […]

The post Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks appeared first on Cyber Security News.

A Chinese-run phishing network has been linked to one billion phishing emails targeting 75,000 organizations, according to a report published on October 14, 2026. The operation centers on Iron Man System, a paid phishing platform that lets criminals deploy fake websites and collect sensitive information without building their own tools. The report lists those headline […]

The post Chinese Phishing Network Linked to 1 Billion Messages Targeting 75,000 Organizations appeared first on Cyber Security News.

Simply viewing an online advertisement can be enough to infect a device with powerful spyware, without the user clicking, downloading a file, or seeing any warning. Citizen Lab researchers documented what they call the first public technical proof of zero-click mercenary spyware delivered through targeted ads. The method, named “AdFection,” infected devices at international news […]

The post Just Viewing an Online Ad Can Infect Your Device With Spyware, Researchers Reveal appeared first on Cyber Security News.

AI agents can expose API keys and cloud secrets during ordinary work, even when no malware is present. When an agent runs a command, reads a configuration file or fetches a secret to complete a task. Even sensitive data can move from protected storage into command histories, logs, agent transcripts and the model’s context. The […]

The post AI Agents Create an Unseen Credential Surface That Exposes API Keys and Cloud Secrets appeared first on Cyber Security News.

ServiceNow has announced a new AI Passport solution and significant advances in AI governance to help ensure AI agents are production-ready by combining runtime governance, platform integration, and comprehensive oversight, all inside ServiceNow’s operational AI harness. Specifically, AI Passport is a new authority layer that gives enterprises runtime control over what AI agents and Model Context Protocol (MCP) servers are authorized to do at every point in a multi-agent workflow. ServiceNow also enables enterprises to … More →

The post ServiceNow gives AI agents a passport, and limits on what they can do appeared first on Help Net Security.

A Windows trojan advertised on hacking forums for as little as $150 a month promises buyers access to a victim’s webcam, microphone, keystrokes and saved passwords, and comes with a set of features made to frighten the person on the other side of the screen. The malware, called KGB RAT, was analyzed by Group-IB malware analysts Alpomish Asadov and Razvan Raducu, who found that it is built on NjRAT, a well-known remote access trojan used … More →

The post KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims appeared first on Help Net Security.

Fake CAPTCHA checks are being used to do more than hide phishing pages. Attackers are turning the familiar “prove you’re human” step into a gateway for malware downloads, malicious browser notifications, and commands that victims are tricked into running themselves, according to Barracuda. The company found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025. These checks help attackers gain users’ trust, filter visitors, and conceal malicious content from automated security tools. … More →

The post Fake CAPTCHAs are tricking users into running malware on their own devices appeared first on Help Net Security.

PEERSTITCH, a memory-resident ARM64 implant deployed against FortiGate firewalls during a prolonged intrusion into a telecommunications managed service provider. The malware hijacks legitimate FortiOS processes, leaving no persistent executable, opening no listening ports, and initiating no outbound connections of its own. Published October 14, the investigation tracks the activity as CL-STA-0954, also known as UNC5820. […]

The post New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.