• A critical SQL injection vulnerability in FreePBX, designated as CVE-2025-57819, has been actively exploited by attackers to modify the database and achieve arbitrary code execution on vulnerable systems. The vulnerability affects the popular open-source PBX platform that provides a web-based administration interface for managing Asterisk VoIP systems across all supported versions including FreePBX 15, 16, and […]

    The post FreePBX SQL Injection Vulnerability Leads to Database Tampering appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A newly identified threat group called Crimson Collective has emerged as a significant security concern for organizations using Amazon Web Services (AWS), employing sophisticated techniques to steal sensitive data and extort victims. The Crimson Collective demonstrates remarkable proficiency in exploiting AWS cloud environments through a methodical approach that begins with compromising long-term access keys. Cybersecurity firm Rapid7 has […]

    The post Crimson Collective Exploits AWS Services to Steal Sensitive Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google rolled out version 141.0.7390.65/.66 for Windows and Mac and 141.0.7390.65 for Linux. This update fixes three critical security flaws, all of which involve memory handling errors that an attacker could exploit to execute arbitrary code in the context of the browser. External researchers discovered these issues and reported them through Google’s vulnerability disclosure program. […]

    The post Multiple Google Chrome Flaws Allow Attackers to Execute Arbitrary Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA has issued a warning about a new zero-day cross-site scripting (XSS) flaw in the Zimbra Collaboration Suite (ZCS). This vulnerability is already in use by attackers to hijack user sessions, steal data, and push malicious filters. Organizations running ZCS should move quickly to apply available fixes or follow guidance to limit risk. Overview of […]

    The post CISA Alerts on Zimbra Collaboration Suite Zero-Day XSS Flaw Exploited in Ongoing Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • BK Technologies Corporation, a Florida-based communications equipment manufacturer, disclosed a significant cybersecurity incident that compromised its IT systems and potentially exposed employee data. The company filed an SEC Form 8-K on October 6, 2025, revealing that attackers gained unauthorized access to sensitive information in late September. Timeline and Discovery of the Breach The cyberattack was […]

    The post BK Technologies Data Breach, IT Systems Compromised, Data Stolen appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A groundbreaking cybersecurity vulnerability has been discovered that transforms everyday computer mice into sophisticated eavesdropping tools. Researchers have developed the “Mic-E-Mouse” attack, which exploits high-performance optical sensors in consumer mice to secretly capture confidential user conversations through acoustic vibrations transmitted via work surfaces. How the Attack Works Through Surface Vibrations The Mic-E-Mouse attack capitalizes on […]

    The post “Mic-E-Mouse” Attack Lets Hackers Steal Sensitive Data via Mouse Sensors appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft is urging organizations to harden Microsoft Teams as threat actors increasingly abuse its built-in collaboration features chat, meetings, voice/video, screen sharing, and app integrations to gain initial access, persist, move laterally, and exfiltrate data. While Microsoft’s Secure Future Initiative has strengthened defaults, effective defense requires actively tuning identity, endpoint, data/app, and network controls around […]

    The post Microsoft Alerts Users as Hackers Exploit Teams Features to Spread Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • As the United States experiences its latest government shutdown, most of the daily operations of the federal government have ground to a halt. This includes much of the day-to-day work done by federal information technology and cybersecurity employees, including those at the nation’s leading civilian cybersecurity agency, the Cybersecurity and Infrastructure Security Agency.

    CISA is among the entities that will see the deepest staffing reductions during the shutdown that began Oct. 1, 2025, according to Department of Homeland Security documentation. Only about one-third of its employees remain on the job after federal employees were furloughed. As if cybersecurity wasn’t challenging enough, fewer CISA employees are being asked to do more and more work protecting American cyberspace during the shutdown. And they’ll be working with the promise of getting paid for their efforts at some date in the future once the shutdown ends.

    The current CISA situation is grim, from my vantage point as a cybersecurity researcher and former industry practitioner. The agency was already experiencing deep cuts to its staff and resources before the shutdown. And now, coinciding with the shutdown, a key law that enabled the agency to facilitate information-sharing with the private sector has expired.

    Taken together, the cyberdefense agency is being hobbled at a time when the need for its services has never been greater, from the ongoing China-led Salt Typhoon attack on U.S. telecommunications networks to ransomware, data breaches and threats to infrastructure.

    CISA was created in 2007 within the Department of Homeland Security. As its name implies, the agency is charged with digital security matters across the federal government. The agency also works with the companies that operate and secure the numerous critical infrastructure sectors of the American economy, such as phone networks, the electric grid and energy pipelines. Additionally, it helps state and local governments across the country secure their vulnerable networks and data.

    CISA also publishes threat and vulnerability alerts for the government and cybersecurity community and engages with public and private stakeholders on best practices in response to emerging vulnerabilities. Prior to the recent expiration of the 2015 Cybersecurity Information Sharing Act, the agency also made it easier for organizations to share useful information with the government to help cybersecurity teams better protect their systems.

    Shutdown-mandated furloughs at the nation’s cybersecurity agency present an opportunity for malicious hackers.

    Political football

    The agency takes a nonpartisan approach to cybersecurity matters. However, some politicians have accused the agency of political bias for its work helping states protect their voting infrastructure from cyberattacks and external influence. The agency was repeatedly maligned for calling the 2020 election the “most secure” in history. For some in elected office, this work on election security has tarnished CISA’s reputation and perhaps explains recent budgetary actions taken against the agency.

    Since the Trump administration took office in January 2025, nearly 1,000 CISA employees have departed the agency through voluntary buyouts or deferred resignations. By the end of May 2025, nearly all of CISA’s senior leaders had resigned or had announced plans to do so.

    For 2026, the president’s draft budget proposes to reduce CISA’s head count by nearly one-third, dramatically cutting staff from its risk management and stakeholder engagement divisions. Other cuts will significantly reduce the agency’s collaboration activities and funding for CISA’s various cybersecurity education and training programs.

    Making the problem worse, the government shutdown began at the same time that Congress failed to renew the Cybersecurity Information Sharing Act. This law provided a legal shield that allowed companies and infrastructure operators to share timely and often sensitive information with CISA about the cyberattacks, vulnerabilities and incidents that they were encountering.

    In the wake of the law’s expiration, prudent companies may consider restricting what information they share with the government. Without the indemnification provided by CISA, many companies will likely have their legal teams review any information to be shared with the government. And that takes time.

    Unfortunately, adversaries do not reduce their attacks against the U.S. based on available federal cyber defense funding or the status of cybersecurity laws. In fact, malicious hackers often strike when their target’s guard is down.

    Charting a better course

    Early in my career I had to work through a prolonged government shutdown. I’ve also participated in and developed assorted public-private information-sharing environments to exchange intelligence and analysis on cyber- and national security matters. And having been in the D.C. area for over 30 years, I’ve seen how government works. So I have a good idea of what’s needed to improve American cybersecurity. The following suggestions are a starting point.

    First, Congress could ensure that critical security agencies such as CISA are immune from the threat of recurring federal government shutdowns. If it desired, Congress could set budgets for America’s security agencies on a biennial basis – as 16 states already do for their entire budgets.

    In terms of cybersecurity funding, the White House’s proposed 2026 budget reduces research and education on cybersecurity. For example, the nation’s premiere federal cybersecurity scholarship program to recruit, educate and place future federal cybersecurity workers would be reduced by over 60%. Protecting this funding would allow CISA and the federal government to maintain the pipeline for a robust and capable cybersecurity workforce both today and into the future.

    Companies could develop new or expand existing nongovernmental information-sharing networks that are not completely dependent on the government to facilitate or fund, such as the Cyber Threat Alliance or the Center for Internet Security. Cybersecurity relies on trust. But right now, the instability of the federal government makes it difficult to rely on any entity under its policy or funding influence, no matter how well time-tested and trusted. Regardless, without legal protections, the information-sharing utility of these services will be limited.

    Cybersecurity risks remain even if the federal government shuts down. So this is another reminder that each of us is responsible for our own cybersecurity. Individual users should continue to remain vigilant, follow accepted best practices for cybersecurity and always be mindful about online risks.

    It’s ironic that the federal government is shutting down, CISA is being eviscerated and the Cybersecurity Information Sharing Act has expired just as the country begins to observe national Cybersecurity Awareness Month – another collaborative public engagement activity that CISA promotes to help improve cybersecurity for all Americans.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Senators across the political spectrum are worried the White House and Pentagon’s focus is drifting from the Indo-Pacific, leaving the U.S. vulnerable to China and other potential adversaries. 

    On Tuesday, lawmakers peppered John Noh, the Trump administration’s pick to lead the Pentagon’s Indo-Pacific affairs, with questions about his plans to restore confidence in the United States from its allies and partners in the region. 

    “The Chinese Communist Party, along with the nuclear-armed Russia and North Korea, pose a significant threat to the United States. The scale and scope of that threat put a premium on our alliances. In light of that, I'm disappointed with some of the decisions the department has made with respect to our allies in Japan, South Korea, Australia and Taiwan. A few of these choices have left me scratching my head,” said Sen. Roger Wicker, R-Miss., who leads the Senate Armed Services Committee. 

    Wicker pressed Noh to “inject more diplomatic skill and mutually beneficial approaches into our conversations with our close allies.”

    Sen. Jack Reed, D-R.I., the committee’s ranking member, went further, saying the administration so far has “undermined years of progress with these allies, threatening troop withdrawals, scaling back joint exercises, imposing erratic tariffs and diverting our strategic forces to unrelated regions and even domestic military deployments. These actions weaken our deterrence and damage trust with our allies.” 

    Noh, the deputy assistant defense secretary for East Asia, repeatedly affirmed the Indo-Pacific’s strategic importance, vowing to deepen existing alliances with Japan, the Republic of Korea, Australia, and the Philippines. 

    “China is undergoing really historic and unprecedented military buildup. It is the most rapid military buildup in history, and the largest since World War II, and it spans both conventional and nuclear as well as cyber and space capabilities,” he said. “This is an enormous concern of mine, and if confirmed, Senator, I will do everything in my power to make sure that we have combat-credible forces postured forward in the western Pacific, along, as you mentioned, the first island chain [and] second island chain.”

    But Noh waffled when pressed with more pointed questions about the Trump administration’s decision to cancel $400 million in military aid to Taiwan. 

    Wicker worried that “DOD may be using the Ukraine playbook with Taiwan by taking defense items procured with presidential drawdown authority and returning it to the defense stockpile” which misaligns with “congressional intent, and would require Taiwan to purchase these items that have already been authorized as PDA.”

    Noh responded by citing President Donald Trump’s stance that Taiwan should spend about 10 percent of its GDP on defense. 

    “Everything that Taiwan does, every extra dollar it spends, every capability it acquires, these are extremely important for the defense of Taiwan, and I certainly applaud the leadership in Taipei for taking those actions in terms of security assistance,” he said. “But Taiwan absolutely needs to do its part and spend more and increase its defense spending and acquire the kind of asymmetric capabilities that will be most relevant for an invasion scenario.” 

    Noh extended that stance to other U.S. allies and partners in the region when asked about combating China’s gray-zone tactics in the region, including incursions of Taiwan’s Air Defense Identification Zone. 

    “We need to make sure that our allies and partners in the region are doing more, are spending more, and are doing their part because…these are enormous difficulties, and these are not threats that the United States can or should address on its own. We need our allies and partners in the region to do their part, including Japan, including Australia, Republic of Korea, Taiwan…”

    But while pushing U.S. allies and partners to spend more on defense is good policy sense, it’s not the whole solution, said one of Noh’s prospective predecessors. 

    “It is profoundly in America's interest to have partners who can provide frontline defenses against China's coercion. When our allies are more capable, they can do more on their own. They can contribute more to our collective defense, and in doing so, they can help to strengthen deterrence and reduce the costs and risks shouldered by U.S. forces. This is why the Trump administration, tactics aside, is doing the right thing by urging our partners to spend more on defense,” Ely Ratner, who served as assistant defense secretary for Indo-Pacific security affairs in the Biden administration, said at a Senate Foreign Relations Subcommittee hearing on Tuesday. “But many of them can't do it entirely on their own, whether in the case of the Philippines or the Pacific Islands.”

    Ratner, now principal at The Marathon Initiative, went on to say he was concerned that current U.S. policy means less support for Taiwan, which could lead to instability in the region. 

    “To be frank, I'm concerned that the current direction of U.S. policy is reducing U.S. support for Taiwan and undermining America's commitment to peace and stability in the Taiwan Strait,” he said. “Congress can lead by advancing an all-of-the-above strategy for Taiwan's defense and resilience that uses the full set of tools available, consistent with and reaffirming our commitments under the Taiwan Relations Act. That should include timely foreign military sales, foreign military financing, presidential drawdown authority, and support for Taiwan's defense industrial base.”

    During Noh’s confirmation hearing, Sen. Mark Kelly, D-Ariz., said he is concerned about Trump administration’s plans to shift focus from the Indo-Pacific region in its upcoming national defense strategy. 

    “There are some rumors, I guess, circulating that the new national defense strategy is going to shift priority away from the PRC and away from the Indo-Pacific, and instead focus on the Western Hemisphere. We'll see what happens when that comes out,” Kelly said. “If that's true…this shift is alarming, because most of what is briefed to this committee focuses on how are we going to deter China. So suddenly shifting away from what I view as our biggest near-peer or peer adversary might strategically leave us in a very vulnerable place, with regards to the Ind- Pacific.” 

    To that, Noh vowed to keep the region a top priority “by making sure that we have all the resources we need to strengthen deterrence in the IndoPacific. That's what I've been doing since joining the department in January, and if confirmed, Senator, I will continue to do so.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In July, stakeholder outcry scuttled a Department of Homeland Security plan to slash the staff of its Office of Intelligence and Analysis. Now DHS is trying again—with buyouts and early-retirement offers.

    The offers to apply to the deferred resignation program, or DRP, were modeled on the Office of Personnel Management’s “fork in the road” effort and sent twice to I&A staffers since July, according to a copy of one of those offer emails issued in September and a person familiar with the matter. The person spoke on the condition of anonymity because they were not authorized to publicly discuss the plans. The email also included options to participate in a Voluntary Separation Incentive Program and Voluntary Early Retirement Authority. 

    The offers were extended after Nextgov/FCW reported in July that the intelligence agency was seeking to jettison most of its employees. Those plans, which would have kept only about 275 of 1,000 staffers, drew pushback from law-enforcement groups and Jewish organizations that have long relied on the DHS spy agency to disseminate timely intelligence about threats to state, local, tribal, and territorial communities. One organization privately warned Congress that the proposed cuts would create “dangerous intelligence gaps.”

    The cuts were put on hold just days later, Nextgov/FCW first reported.

    But I&A is still working to halve its workforce, albeit more slowly, according to the person. The office has already shed about 300 people through early retirement and an initial DRP offering, the person said. It now aims to shed another 200 through a second round of DRP, essentially halving the workforce since January, the person said.

    I&A employees had until Sept. 14 to submit their information for the second deferred resignation, according to the email. Approved staff would remain on administrative leave for 12 weeks, giving them pay until early December, it adds. It is not clear how the current shutdown affects these agreements.

    The programs “provide an opportunity to make decisions as part of the restructuring effort underway in DHS headquarters,” the email says. It was not immediately clear how many people inside the agency elected to take the DRP.

    For years, intelligence insiders and outside experts have said I&A needed a reorganization to operate more effectively—and to install guardrails against the domestic overreach it has been widely accused of in the past. But the deep cuts proposed over the summer put the office at odds with the communities it serves.

    The office is one of 18 in the U.S. intelligence community, and one of two under DHS, along with Coast Guard Intelligence. I&A was created shortly after the September 11 terrorist attacks to help disseminate information about domestic threat.

    U.S. spy agencies, including major offices like the NSA and CIA, have been marked for workforce reductions in President Donald Trump’s second term. Various intelligence offices are also affected amid the ongoing government shutdown. I&A has 544 employees who are still working during the lapse in federal funding, according to a DHS planning document. 

    DHS did not immediately respond to a request for comment.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶