Security teams worldwide are rushing to patch systems after the disclosure of a critical React vulnerability, CVE-2025-55182, widely known as “React2Shell.” The flaw affects React Server Components (RSC) and has a maximum CVSS score of 10, the highest possible rating, signaling critical impact and ease of exploitation. Censys telemetry shows that more than 2.15 million internet‑facing services are […]

The post 2.15M Next.js Web Services Exposed Online, Active Attacks Reported – Update Immediately appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A newly discovered Android banking trojan, FvncBot, has emerged as a sophisticated threat targeting mobile banking users in Poland. Researchers from Intel 471 first identified this malware on November 25, 2025, disguised as a security application from mBank, one of Poland’s most prominent banking institutions.​ Novel Malware with Advanced Capabilities FvncBot represents an entirely new […]

The post FvncBot Android Malware Steals Keystrokes and Injects Harmful Payloads appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

SAFA researchers uncovered four kernel heap overflow vulnerabilities in Avast Antivirus’s aswSnx.sys driver, designated CVE-2025-13032, affecting versions before 25.3 on Windows. These flaws originate from double-fetch issues in IOCTL handling, allow local attackers to trigger pool overflows for privilege escalation to SYSTEM. The vulnerabilities require sandbox manipulation to access the attack surface, marking a reversal […]

The post Avast Antivirus Sandbox Vulnerabilities Allow Privilege Escalation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A newly disclosed critical vulnerability in Apache Tika could allow attackers to compromise servers by simply uploading a malicious PDF file, according to a security advisory published by Apache maintainers. Tracked as CVE-2025-66516, the flaw affects Apache Tika core, Apache Tika parsers, and the Apache Tika PDF parser module. CVE ID Severity Vulnerability Type Affected Component Affected Versions CVE-2025-66516 Critical XML External […]

The post Apache Tika Core Flaw Allows Attackers to Exploit Systems with Malicious PDF Uploads appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The UK’s National Cyber Security Centre (NCSC) has introduced a new initiative designed to protect organisations from cyber threats. Working alongside Netcraft, the NCSC has launched the Proactive Notification Service, a groundbreaking program that identifies and alerts system owners about security vulnerabilities affecting their networks. How the Service Works The Proactive Notification Service operates by scanning […]

The post NCSC Launches Proactive Notification Service to Alert System Owners of Vulnerabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cloudflare has announced that it is currently experiencing a significant outage impacting its Dashboard and Cloudflare API services. Many users around the world are reporting issues such as 500 Internal Server Errors, failed API requests, and sudden disruptions in tools that depend on Cloudflare’s backend systems. According to the cloudflare, the problem mainly affects the […]

The post Cloudflare Outage Triggers Widespread 500 Internal Server Errors appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A sophisticated phishing campaign is targeting users through Microsoft Teams notifications, exploiting the platform’s trusted status to deliver deceptive messages that appear legitimate to both recipients and email security filters. Threat actors are leveraging Teams’ official notification system to send emails from the no-reply@teams.mail.microsoft address, creating a false sense of authenticity that makes detection increasingly difficult. The […]

The post Hackers Abuse Microsoft Teams Notifications to Launch Callback Phishing Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A newly disclosed security flaw in the open-source monitoring platform Cacti could allow attackers to execute arbitrary commands on vulnerable servers. The issue, rated High severity and tracked as CVE-2025-66399, affects Cacti versions up to and including 1.2.28. The problem has been fixed in Cacti 1.2.29. The vulnerability stems from improper input validation in the SNMP device configuration workflow. When an authenticated […]

The post Cacti Command Injection Flaw Allows Remote Execution of Malicious Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA), joined by Canadian cyber authorities, have issued a joint alert warning of a sophisticated new malware campaign dubbed “BRICKSTORM.” According to the advisory released, state-sponsored hackers from the People’s Republic of China (PRC) are actively using this tool to infiltrate and hide […]

The post CISA, NSA Alert on BRICKSTORM Malware Targeting VMware ESXi and Windows Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A security researcher has unveiled a novel web exploitation technique dubbed “SVG clickjacking,” which significantly elevates the sophistication of traditional user-interface redress attacks. Unlike standard clickjacking, which typically involves tricking users into clicking a hidden button on a static overlay, this new method allows attackers to create complex, responsive, and highly interactive fake interfaces that […]

The post New SVG Technique Enables Highly Interactive Clickjacking Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Kohler’s Dekota toilet camera, launched in October as a $600 health-monitoring device, is facing significant scrutiny over its privacy claims. The device promises to track gut health, hydration, and other wellness metrics by analyzing bowel contents. However, the investigation reveals the company’s assurances about data protection are misleading. Kohler prominently advertises “end-to-end encryption” across its […]

The post Kohler’s Smart Toilet Camera Not Truly End-to-End Encrypted appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Security researchers have released a specialized scanning tool to identify vulnerable React Server Component (RSC) endpoints in modern web applications, addressing a critical gap in the detection of CVE-2025-55182. New Detection Approach Challenges Existing Security Assumptions A newly available Python-based scanner is transforming how organizations assess their exposure to CVE-2025-55182 by introducing a sophisticated surface […]

The post New Scanner Released to Detect Exposed ReactJS and Next.js RSC Endpoints (CVE-2025-55182) appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A high security vulnerability has been discovered in Vim for Windows that could allow attackers to run malicious code on affected systems. The flaw, tracked as CVE-2025-66476, affects Vim versions earlier than 9.1.1947 and received a high severity rating due to its serious implications for Windows users. Attribute Details CVE ID CVE-2025-66476 Product Vim for […]

The post Vim for Windows Flaw Lets Attackers Execute Arbitrary Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Akamai has fixed a vulnerability in its edge servers that could have allowed HTTP Request Smuggling attacks. The issue was entirely resolved on November 17, 2025, and the company says no action is needed from customers. The flaw is now tracked as CVE-2025-66373. Field Detail CVE ID CVE-2025-66373 Vendor Akamai Component Akamai edge servers Vulnerability […]

The post Akamai Fixes HTTP Request Smuggling Flaw in Edge Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A significant cybersecurity incident affecting multiple U.S. financial institutions came to light on November 26, 2025, when Marquis Software Solutions notified affected customers of a ransomware attack. The breach, discovered on August 14, 2025, compromised the personal information of thousands of customers across numerous banks and credit unions throughout the United States. Marquis Software Solutions, […]

The post Marquis Data Breach Exposes Dozens of U.S. Banks and Credit Unions appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical security vulnerability has been discovered in K7 Ultimate Security antivirus software that allows attackers to gain the highest level of system access on Windows computers. The flaw, tracked as CVE-2024-36424, enables low-privileged users to escalate their permissions to SYSTEM level, giving them complete control over affected machines. How the Vulnerability Works K7 Ultimate Security […]

The post K7 Antivirus Flaw Lets Attackers Gain SYSTEM-Level Privileges appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A newly discovered security flaw in Windows shortcut files is being actively used by hackers to target diplomatic organisations. The vulnerability allows attackers to conceal malicious commands within shortcut files (.lnk), making them invisible to users. The Discovery and Initial Rejection The issue was first highlighted in March 2025 by researchers at Trend Micro. They […]

The post Hackers Actively Exploit New Windows LNK 0-Day Vulnerability appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Let’s Encrypt, the nonprofit certificate authority serving millions of websites, announced a significant shift in how it issues digital certificates. Starting in 2026, the organization will reduce the validity period of its SSL/TLS certificates from 90 days to 45 days, with complete implementation expected by February 2028. The move aligns Let’s Encrypt with broader industry […]

The post Let’s Encrypt Cutting Certificate Lifespan from 90 Days to 45 Days appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory warning about a critical remote code execution vulnerability affecting Industrial Video & Control’s Longwatch video surveillance and monitoring system. The flaw enables unauthenticated attackers to execute arbitrary code with SYSTEM-level privileges, posing significant risks to organizations using the affected platform. Critical Vulnerability Details The […]

The post Longwatch RCE Flaw Allows Attackers to Run Remote Code with Elevated Privileges appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The United States Justice Department has seized a website domain used to steal money from Americans through fake cryptocurrency investments. The domain, tickmilleas.com, was operated by the Tai Chang scam compound located in Kyaukhat, Burma. This action comes less than three weeks after the launch of Washington D.C.’s new “Scam Center Strike Force” and the […]

The post Authorities Seize Domains Linked to Tai Chang Cryptocurrency Investment Scam appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.