• A threat actor has claimed responsibility for a significant data breach at Huawei Technologies, a multinational technology corporation based in China.

    The actor is reportedly attempting to sell what they allege is the company’s internal source code and development tools on a dark web forum.

    The post, which appeared in early October 2025, asserts that the breach resulted in the exfiltration of sensitive intellectual property.

    Details Of The Alleged Breach

    According to the threat actor’s post, the compromised data includes a wide range of internal assets. The actor specifically listed source code, development tools, build files, scripts, and technical manuals as being part of the stolen data package.

    An image of the forum post shows the actor asking for $1,000, with the price open to negotiation, and communication restricted to the Session messaging platform.

    Huawei Alleged Breach Claim
    Huawei Alleged Breach Claim

    The incident has drawn attention from cybersecurity intelligence groups that monitor dark web activities. This alleged incident adds to a long history of security scrutiny and espionage accusations leveled against Huawei.

    For years, the U.S. government and other Western nations have raised concerns that the Chinese government could use Huawei’s equipment for espionage.

    These concerns date back to at least 2012, when a U.S. House Intelligence Committee report warned that using Huawei’s technology could undermine U.S. national security interests.

    The company has also faced multiple allegations of intellectual property theft from competitors. Past security incidents have kept Huawei under a microscope.

    In 2019, reports emerged that Vodafone Italy had discovered hidden backdoors in Huawei equipment between 2009 and 2012, which could have granted unauthorized access to the carrier’s network.

    While Huawei described the backdoors as “technical mistakes” that were later fixed, the findings damaged the company’s reputation.

    More recently, in July 2025, a nationwide telecom outage in Luxembourg was reportedly linked to a cyberattack targeting Huawei routers, prompting a government investigation. The company has also been the target of state-sponsored hacking, with reports confirming that the U.S.

    National Security Agency (NSA) infiltrated Huawei’s servers in 2009 to find links to the Chinese military and steal source code. The full impact and authenticity of this latest claimed breach are still under investigation.

    If validated, the exposure of Huawei’s source code and internal tools could have far-reaching consequences, potentially exposing new vulnerabilities in its products and providing malicious actors with the means to compromise the company’s extensive global infrastructure.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Threat Actors Claim Breach Of Huawei Technologies Source Code and Internal Tools appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A Chinese company named the Beijing Institute of Electronics Technology and Application (BIETA) has been assessed to be likely led by the Ministry of State Security (MSS). The assessment comes from evidence that at least four BIETA personnel have clear or possible links to MSS officers and their relationship with the University of International Relations, which is known to share links with the

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Doctors Imaging Group, a healthcare provider based in Florida, has reported a significant data breach that exposed the sensitive personal and medical information of over 171,800 individuals.

    The incident, classified as a “Hacking/IT Incident,” involved unauthorized access to the organization’s network server, leading to the compromise of a wide range of highly sensitive data.

    According to the company’s notice, the breach occurred over a one-week period between November 5, 2024, and November 11, 2024. During this time, unauthorized actors gained access to the provider’s computer network and copied files containing patient information.

    Doctors Imaging Group became aware of suspicious activity and immediately launched an investigation to determine the scope of the intrusion.

    The comprehensive review of the affected files to identify the specific information compromised and the individuals involved was a lengthy process, concluding nearly ten months later on August 29, 2025. The breach was officially reported to the relevant authorities on September 24, 2025.

    Breach Timeline And Discovery

    The investigation confirmed that a significant amount of both Protected Health Information (PHI) and Personally Identifiable Information (PII) was exposed.

    The compromised data includes patient names, addresses, dates of birth, and Social Security numbers. Furthermore, detailed medical and financial information was also involved, such as patient account numbers, medical record numbers, admission dates, health insurance details, medical treatment information, and medical claim information.

    Financial data, including financial account numbers and account types, was also part of the breach, placing affected individuals at a heightened risk of identity theft and financial fraud.

    In response to the incident, Doctors Imaging Group has stated it took immediate action to investigate the suspicious activity and assess the security of its network.

    The company notified federal law enforcement and other regulatory authorities about the breach. Notification letters are being sent to all individuals whose information was compromised and for whom address information is available.

    As part of its remediation efforts, the healthcare provider is reviewing its internal security policies and procedures and is evaluating new cybersecurity tools to prevent similar incidents in the future.

    The company advises all potentially impacted individuals to remain vigilant by carefully reviewing their account statements, explanation of benefits statements, and credit reports for any signs of suspicious activity.

    Any detected errors or fraudulent activity should be promptly reported to the relevant financial institution, insurance company, or healthcare provider.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Doctors Imaging Group Suffers Data Breach – 171800+ Users Data Exposed appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Forensic-Timeliner, a Windows forensic tool for DFIR investigators, has released version 2.2, which offers enhanced automation and improved artifact support for digital forensics and incident response operations.

    This high-speed processing engine consolidates CSV output from leading triage utilities into a unified timeline, empowering analysts to reconstruct event sequences and identify key indicators of compromise rapidly.

    Automated Timeline Construction

    Developed by Acquired Security, the tool’s core capability lies in its ability to discover and parse CSV artifacts generated by EZ Tools, KAPE, Axiom, Chainsaw, Hayabusa, and Nirsoft. Analysts simply point the tool at a base directory:

    Forensic-Timeliner
    Forensic-Timeliner

    Interactive Menu

    The engine applies YAML-driven filters defined in config/keywords/keywords.yaml, automatically detecting files by name, folder, or header patterns. New interactive enhancements in v2.2 include:

    • Silent mode (–Silent) to suppress prompts and banners, facilitating headless execution in automated workflows.
    • Filter previews rendered as Spectre.Console tables, allowing live validation of MFT timestamp filters, event-log channel/provider rules, and keyword tagger configurations.
    • Keyword tagging support for Timeline Explorer (.tle_sess): tagged events are grouped by user-defined keyword sets, simplifying pivoting in downstream analysis.
    Timeline Explorer Support 
    Timeline Explorer Support 

    These tool features reduce manual effort and ensure repeatable, auditable processing across large-scale collections. Beyond basic timeline collation, Forensic-Timeliner offers advanced enrichment and export options.

    Date filtering (–StartDate, –EndDate) and deduplication (–Deduplicate) to tailor timelines to the incident’s window of interest.

    Raw data inclusion (–IncludeRawData) for forensic provenance, embedding original CSV rows in the output for forensic validation.

    Configurable parsers via YAML definitions, mapping artifact CSV fields to a standard timeline schema:

    DateTime | TimestampInfo | ArtifactName | Tool | Description | DataDetails | DataPath | FileExtension | EventId | User | Computer | FileSize | IPAddress | SHA1 | Count | EvidencePath.

    The tool’s RFC-4180-compliant CSV output ensures seamless compatibility with Excel, Timeline Explorer, and other forensic review platforms. Analysts can also export in JSON or JSONL formats for integration with SIEMs and log management systems.

    Customizable YAML parameters allow exclusion of undesired MFT extensions (default: .exe, .ps1, .zip, etc.) and path filters (default: Users), while built-in event-log filters restrict noise by channel and provider IDs.

    Forensic-Timeliner v2.2’s mix of interactive setup, automated discovery, and keyword-driven enrichment positions it as an indispensable tool for DFIR investigators seeking speed, precision, and consistency in constructing Windows forensic timelines.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Forensic-Timeliner – Windows Forensic Tool for DFIR Investigators appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • NCSC has issued an urgent warning regarding a critical zero-day flaw in Oracle E-Business Suite (EBS) that is currently being exploited in the wild. 

    Tracked as CVE-2025-61882, the vulnerability resides in the BI Publisher Integration component of Oracle Concurrent Processing and allows unauthenticated remote code execution. 

    Organisations running EBS versions 12.2.3 through 12.2.14—especially those exposed to the internet are at the highest risk.

    Oracle BI Publisher Flaw (CVE-2025-61882)

    Oracle’s security alert confirms that an attacker can send specially crafted HTTP requests to the BI Publisher Integration servlet without any prior authentication, achieving full system compromise. 

    No user interaction is required. A proof-of-concept HTTP request pattern resembles the following:

    NCSC Warns Oracle E-Business Suite 0-Day Vulnerability

    Successful exploitation could allow arbitrary command execution under the Oracle EBS application account, potentially leading to data exfiltration, system takeover, or lateral movement across the corporate network. 

    Indicators of compromise (IoCs) published in Oracle’s advisory include anomalous servlet URIs, unexpected child processes spawned by $XBPSRV, and suspicious outbound connections on non-standard ports.

    The NCSC is closely monitoring incident reports and has observed multiple exploitation attempts against UK organisations. 

    Exposed EBS instances on the public internet are the primary target, although internal networks lacking proper segmentation may also be vulnerable to threat actors who gain an initial foothold.

    Risk FactorsDetails
    Affected ProductsOracle E-Business Suite (EBS) 12.2.3 – 12.2.14; BI Publisher Integration component of Oracle Concurrent Processing
    ImpactRemote code execution (RCE)
    Exploit PrerequisitesNetwork access to exposed BI Publisher Integration endpoint; no authentication or user interaction required
    CVSS 3.1 Score9.8 (Critical)

    Mitigation 

    To address CVE-2025-61882, the NCSC urges UK organisations to adopt a defense-in-depth approach.

    Apply Oracle’s October 2023 Critical Patch Update followed by the dedicated EBS patch for CVE-2025-61882. Oracle’s advisory provides detailed installation instructions.

    NCSC Warns Oracle E-Business Suite 0-Day Vulnerability

    Leverage the published IoCs to scan logs, web access records, and process listings for signs of exploitation. Tools such as grep and SIEM rules can help identify:

    NCSC Warns Oracle E-Business Suite 0-Day Vulnerability

    Limit public exposure of Oracle EBS components. Where internet access is unavoidable, implement web application firewalls (WAFs), strict access control lists (ACLs), and network perimeter guidelines as outlined by the NCSC.

    Deploy EDR agents on application servers and conduct behavioral analysis to detect anomalous child processes or unusual outbound traffic.

    If compromise is suspected, contact Oracle PSIRT and report to the NCSC via its online portal. Early notification can help coordinate response and threat intelligence sharing.

    Additional free NCSC resources include guidance on vulnerability management, preventing lateral movement, and the Early Warning service for real-time alerts. 

    By taking these precautions, Oracle E-Business Suite resilience would be strengthened against present and upcoming vulnerabilities.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post NCSC Warns of Oracle E-Business Suite 0-Day Vulnerability Actively Exploited in Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hosted at the repository “Huckel789/Android-RAT,” this fully undetectable (FUD) RAT is designed to evade antivirus detection permanently, maintain persistence in battery-optimized environments, and deliver a feature-rich command-and-control (C2C) experience entirely from a web interface. This Android RAT sets itself apart by eliminating the traditional requirement for a desktop or laptop in the attack chain. A […]

    The post New ‘Fully Undetectable’ Android RAT Discovered on GitHub appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers are reporting an alleged security breach involving Chinese technology giant Huawei Technologies, with hackers claiming to have accessed and leaked sensitive source code and internal development tools. The incident, which surfaced through social media channels, represents a potentially significant security compromise of one of the world’s largest telecommunications equipment manufacturers. Hacker illustrating world’s biggest […]

    The post Hackers Allegedly Breach Huawei Technologies, Leak Source Code and Internal Tools appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical security vulnerability has been discovered in Zabbix Agent and Agent 2 for Windows that allows attackers with local system access to escalate their privileges through DLL injection attacks. 

    The flaw, tracked as CVE-2025-27237 with a CVSS score of 7.3 (High), affects multiple versions of the popular network monitoring solution and has prompted immediate security updates from Zabbix.

    The vulnerability stems from improper handling of OpenSSL configuration files in Windows environments, where the configuration file is loaded from a path that can be modified by low-privileged users. 

    This design flaw creates an attack vector for malicious actors who can inject dynamic link libraries (DLLs) to gain elevated system privileges.

    Zabbix Agent Windows Local Privilege Escalation

    The security flaw resides in how Zabbix Agent and Agent 2 process OpenSSL configuration files on Windows systems. 

    When these agents initialize, they load the OpenSSL configuration from a file path that has insufficient access controls, allowing users with limited privileges to modify the configuration content. 

    The attack requires local system access and involves modifying the OpenSSL configuration file to reference a malicious DLL that gets loaded during the agent’s startup or system restart process.

    The vulnerability affects a broad range of Zabbix versions, including 6.0.0 through 6.0.40, 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, and 7.4.0 through 7.4.1. 

    The attack vector has specific prerequisites: attackers need existing access to the Windows system with Zabbix Agent installed, and the malicious configuration only takes effect after the Zabbix Agent service restarts or the system reboots.

    Security researcher himbeer discovered this vulnerability and reported it through Zabbix’s HackerOne bug bounty program. 

    The DLL injection technique exploits the trust relationship between the Zabbix Agent service and the OpenSSL library, allowing attackers to execute arbitrary code with the elevated privileges of the agent process.

    Risk FactorsDetails
    Affected Products– Zabbix Agent for Windows 6.0.0 – 6.0.40- Zabbix Agent for Windows 7.0.0 – 7.0.17- Zabbix Agent2 for Windows 7.2.0 – 7.2.11- Zabbix Agent2 for Windows 7.4.0 – 7.4.1
    ImpactLocal privilege escalation
    Exploit Prerequisites– Local Windows user account- Zabbix Agent or Agent 2 installed- Ability to modify OpenSSL configuration file path- Agent service or system restart to load malicious DLL
    CVSS 3.1 Score7.8 (High)

    Mitigations

    Zabbix has released security patches across all affected product lines to address this privilege escalation vulnerability. 

    The fixed versions include 6.0.41, 7.0.18, 7.2.12, and 7.4.2, which implement proper access controls for OpenSSL configuration file paths and validate configuration content before processing.

    System administrators should immediately update their Zabbix Agent installations to the corresponding patched versions. 

    The company has not provided specific workarounds for this vulnerability, making the security updates the primary mitigation strategy. 

    Organizations using Zabbix monitoring infrastructure should prioritize these updates, particularly in environments where multiple users have local system access or where the monitoring agents run with elevated privileges.

    Given the widespread deployment of Zabbix monitoring solutions in enterprise environments, this security flaw could potentially affect thousands of Windows-based monitoring installations globally.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Zabbix Agent and Agent 2 for Windows Vulnerability Let Attackers Escalate Privileges appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated malware campaign dubbed TamperedChef has successfully compromised European organizations by masquerading as a legitimate PDF editor application, according to new research from WithSecure’s Strategic Threat Intelligence & Research Group (STINGR). The campaign demonstrates how threat actors can leverage convincing advertising strategies and fully functional decoy applications to harvest sensitive credentials and establish persistent […]

    The post TamperedChef Malware Disguised as PDF Editor Hijacks Browser Credentials and Opens Backdoors appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The cyber world never hits pause, and staying alert matters more than ever. Every week brings new tricks, smarter attacks, and fresh lessons from the field. This recap cuts through the noise to share what really matters—key trends, warning signs, and stories shaping today’s security landscape. Whether you’re defending systems or just keeping up, these highlights help you spot what’s coming

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶