• QR-code phishing, commonly known as quishing, is evolving beyond image-based payloads. Threat actors are now rendering scannable QR codes directly from HTML tables or text within email bodies, leaving no image attachment, embedded bitmap, or <img> element for traditional email scanners to inspect. The technique targets a structural blind spot in Secure Email Gateways (SEGs). […]

    The post HTML-Rendered QR Phishing Evades Image Extraction and OCR-Based Email Scanning appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat actors are leveraging the trusted Node.js JavaScript runtime in multiple cyber attacks as a way to deploy malicious payloads. According to a new report published by the Symantec Threat Hunter Team today, the attack method has been put to use in attacks targeting government departments, technology companies, and hotels since February 2026. “The technique’s appeal is that node.exe (the

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In early August, GitGuardian researchers found that a recent Shai-Hulud infostealer worm variant had evolved to scan for credentials across 469 locations across developer environments, Continuous Integration/Continuous Deployment (CI/CD) tooling, cloud configurations, and even AI tool configs. Earlier variants of the infostealer worm only checked 189 paths. The jump says a lot. Attackers have

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • StreamRAT, a newly identified Android banking trojan distributed through fake free-TV streaming advertisements on Meta and TikTok. The campaign, tracked as “Steamtv Esp.,” primarily targeted Spanish-speaking Android users and exposed an estimated 570,000 Meta users between June 11 and July 3, 2026. The operation highlights the continued effectiveness of piracy-themed social engineering. Victims who clicked […]

    The post StreamRAT Abuses Android Accessibility, MediaProjection and HVNC for Full Device Takeover appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A high-severity vulnerability affecting over 5 million active WordPress installations could allow unauthenticated attackers to exploit stored SQL injection vulnerabilities, leading to remote code execution and complete website takeover. This issue, tracked as CVE-2026-19949, impacts the widely used All-in-One WP Migration and Backup plugin developed by ServMask. Wordfence has rated the vulnerability 8.8 out of […]

    The post WordPress Plugin Flaw Lets Attackers Turn SQL Injection Into Complete Site Takeover appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security researchers have reported active exploitation attempts targeting a critical vulnerability in Sangoma Switchvox, allowing unauthenticated attackers to execute code remotely via SQL injection. This vulnerability, tracked as CVE-2026-9586, affects internet-exposed Switchvox enterprise VoIP systems and was addressed in Switchvox version 8.4.0.2. Sangoma Switchvox RCE Flaw Zach Hanley, a researcher at Horizon3.ai, revealed that this […]

    The post Sangoma Switchvox RCE Flaw Actively Exploited in Wild via Unauthenticated SQL Injection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Three high-severity vulnerabilities in HP Easy Start for macOS could allow both local and network-positioned attackers to disrupt the printer software installation process and, under certain conditions, gain privileged access or modify files with root permissions. These vulnerabilities, tracked as CVE-2026-12554, CVE-2026-12555, and CVE-2026-12556, were discovered by researcher Nir Yehoshua from Cipher Security Labs during […]

    The post Three HP Easy Start Flaws Let Attackers Gain Root Privileges on macOS appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The iPhone belonging to a member of Serbia’s student protest movement was infected with NSO Group’s Pegasus spyware, according to new findings from the Citizen Lab in collaboration with the SHARE Foundation. “Our analysis confirmed that an iMessage zero-click exploit was used to infect the device with NSO Group’s Pegasus spyware,” the Citizen Lab said. “We found high-confidence indicators of

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cisco has released security updates addressing a critical vulnerability in Nexus 9000 Series switches that could allow unauthenticated remote attackers to execute arbitrary code with root privileges. This vulnerability, tracked as CVE-2026-20212, has a CVSS score of 9.8 and affects Nexus 9000 platforms that are equipped with Cisco Silicon One ASICs. Cisco Nexus 9000 Flaw […]

    The post Critical Cisco Nexus 9000 Flaw Lets Remote Attackers Execute Code as Root Without Authentication appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • LYNN, Mass.—Rosie the robot and her automated compatriot Thomas are the stars of GE Aerospace’s automated manufacturing line at the company’s factory here. Decked in yellow, the towering machines are reminiscent of the Transformer Bumblebee’s dislocated arms. They move in concert seamlessly to collect tools, machine parts, and assemble components for the T700, which are found in Boeing’s Apache and Sikorsky’s Black Hawks, and, in the future,T408 engines for the Marine Corps’ CH-53-K King Stallion. 

    It’s part of a multiyear $100 million investment in the plant, which is hyperfocused on upgrades—from machines to workflows—to make more engines and deliver them faster. 

    “This was historically a bottleneck for our businesses,” Dan Martin, who manages manufacturing engineering and leads a team charged with integrating robotics and automation inLynn plant, said of the piece of the business that makes rotating parts, like cooling plates. “We had quality issues here. We had capacity issues here. The robotics piece now comes online, and these lines are no longer constrained for us.”

    That need to go fast will be key once the military starts putting in high-volume orders for collaborative combat aircraft, or robot wingmen for fighter jets.

    “We're designing from the very beginning to meet the right production,” starting with small engines, Amy Gowder, GE Aerospace's president and CEO for its defense and systems division, told reporters Monday. For example, “we did a seven-way exercise, and we're like, ‘no, we need a tack time of 100 seconds for each [screw], not an hour and a half,” for 70 screws.

    In addition to changing techniques and design practices, Gowder said the company is looking for suppliers that are “used to the high volumes we need.” 

    For the F404/F414 engine, which is found in the F/A-18, “we're trying to move to a different supply base that has different commercial off-the-shelf type standards that have operated at this volume,” she said. “And when we tell them we want to go from one engine a month to 20 engines a month in like six months or a year, that doesn't phase them because they're used to handling the volumes. Only when you get to like 100 engines a month do they start to say, ‘hey, I might need some some investments or capacity to meet that.’” 

    GE is also conducting “producibility reviews” as it brings on suppliers, she said. 

    “So we think we designed it correctly. We think we've chosen the right types of suppliers that have the capacity and processes we need, but as they actually get the drawing and figure out how they're going to make it for the first time, we're there with them [to review] other changes before we lock in that final design.” 

    Welcome

    You’ve reached the Defense Business Brief, where we dig into what the Pentagon buys, who they’re buying from, and why. Send along your tips, feedback, and song recommendations to lwilliams@defenseone.com. Check out the Defense Business Brief archive here, and tell your friends to subscribe!

    Next up: Hypersonic testing. The Pentagon’s innovation arm tapped GE Aerospace to develop a hypersonic test bed as part of the Hypersonic and High-Cadence Airborne Testing Capabilities, or HyCAT, program. The award follows one for a prototype in 2023. The first flight is targeted for 2028. 

    • “This is a significant milestone for our hypersonics team,” where “we're the prime, but we're also providing a dual-mode ramjet,” which can make the vehicle go faster and further, while “working with a number of other platforms to provide an all-up round to support this high-cadence hypersonic testing capability,” Steve “Doogie” Russell, VP and general manager of GE’s Edison Works, told reporters.
    • But the company isn’t interested in developing a weapons system, Russell said.
    • “This is a case where we do have the ability to be the full integrator for this test bed project, but we're really focused on being a propulsion solution provider across this spectrum of activity. Same thing with the low-cost small-engine side of things.”
    • The engine-maker is working with several other companies, but declined to name them or discuss product ranges. 
    • GE Aerospace also plans to use the solution to test other payloads, including engine upgrades, said Dean Modroukas, general manager of hypersonics. 
    • “The best way to assess hypersonic systems is to make sure that you've got plenty of time in an operating mode that's relevant for things like thermal equilibrium, maneuverability,” Modroukas said. “HyCat is the second step of what we're doing to develop a test bed and test capability that allows us to bring our engines into flight. So we're always looking forward in terms of ways that we can learn quickly and through testing both on the ground, but end of the day, in a relevant environment, is [that] you want to be in the air.” 

    One more engine-related thing: The Navy certified Rolls-Royce’s mtu series 4000 and 2000 marine engines to power autonomous surface vessels.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶