• EvilTokens is pushing phishing-as-a-service beyond credential theft by abusing Microsoft’s device authorization flow to obtain valid Microsoft 365 tokens. Victims can complete a legitimate Microsoft sign-in and MFA challenge, yet unknowingly authorize an attacker-controlled session. The PhaaS operation was advertised on Telegram from mid-February 2026 and was later documented by Sekoia researchers as a turnkey […]

    The post EvilTokens Abuses Microsoft Device Codes to Hijack Accounts Without Stealing Passwords appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • TP-Link has released firmware updates for three Archer router models due to the discovery of multiple command injection vulnerabilities. These vulnerabilities could enable attackers to execute arbitrary operating system commands with root privileges. The security advisory, updated on August 24, 2026, pertains to the Archer BE800 V1, Archer BE3600 V1, and Archer AX75 V1 devices. […]

    The post TP-Link Archer Command Injection Flaws Enable Root-Level Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybercriminals are capitalizing on renewed interest in Grand Theft Auto VI by pushing fake Rockstar Games pages that advertise a non-existent GTA 6 demo but instead deliver the Vidar information stealer. The campaign targets browser credentials, session cookies, and other profile data that can let attackers access accounts even after victims change their passwords. The […]

    The post Fake GTA 6 Demo Sites Spread Vidar Stealer to Hijack Authenticated Browser Sessions appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a maximum-severity security flaw impacting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-21962 (CVSS score: 10.0), allows an unauthenticated attacker with network access via HTTP to

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A renewed distribution wave for the WeedHack malware-as-a-service operation, with threat actors continuing to push infected Minecraft clients and mods despite the campaign’s original command-and-control infrastructure being disrupted. The researchers found multiple active websites impersonating popular Minecraft projects, offering paid clients at no cost, and abusing well-known hosting platforms to make malicious downloads appear trustworthy. […]

    The post WeedHack Malware Spreads Through SEO-Poisoned Minecraft Sites Despite C2 Disruption appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Oracle HTTP Server to its Known Exploited Vulnerabilities (KEV) Catalog after confirming evidence of active exploitation in the wild. The vulnerability, tracked as CVE-2026-21962, affects both Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. CISA classified this issue as […]

    The post Hackers Exploit Critical Oracle HTTP Server Flaw to Access and Modify Sensitive Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft is introducing a new Microsoft Teams meeting policy that automatically blocks identified external bots. This aims to address growing concerns regarding unauthorized AI notetakers, transcription tools, and recording assistants that may enter sensitive virtual meetings. The new capability was outlined in the Microsoft 365 message center notice MC1459141, published on August 21, 2026. It […]

    The post Microsoft Teams New Security Policy Lets Admins Automatically Block Meeting Bots appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security researcher Martijn van Ramesdonk has disclosed five vulnerabilities affecting Palo Alto Networks’ GlobalProtect, an enterprise VPN and endpoint agent widely used across corporate environments on Windows, macOS, and Linux. The issues include local privilege escalation vulnerabilities that could allow a low-privileged attacker with access to an endpoint to gain full SYSTEM privileges on Windows […]

    The post 5 Palo Alto GlobalProtect Flaws Let Attackers Gain SYSTEM/Root Access and Steal AD Passwords appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New space transportation policy released by the Trump administration Thursday looks to build out the infrastructure capabilities needed to rapidly increase the number of U.S.-led rocket launches in the coming years, including by tying the push with ongoing efforts to modernize the nation’s outdated air traffic control systems. 

    President Donald Trump’s strategy sets a goal of supporting “more than 1,000 launches and reentries” by 2030, largely by prioritizing enhanced commercial sector engagement and increasing the number of launch and entry sites across the country. 

    Building out this infrastructure, the policy says, will entail the Pentagon and NASA working together to “operate Federal launch and reentry ranges and facilities in a transparent manner that accommodates government and non government users.” 

    Other relevant agencies will also need to be involved in these discussions, the strategy adds, to develop and publish range schedules that can “maximize efficient use of range resources for commercial users” and “optimize launch capacity.”

    To help facilitate more space launches in U.S. airspace, the Transportation Department—in coordination with the Pentagon and NASA—is directed to “implement a plan to integrate space launch and reentry management into airspace and traffic control modernization efforts” and “designate priority airspace for critical space launch corridors” within 180 days of the policy’s release.

    Under Transportation’s leadership, the Federal Aviation Administration has been driving the administration’s effort to radically overhaul the nation’s outdated air traffic control systems.

    The modernization initiative was announced by Transportation Secretary Sean Duffy in May 2025 and followed several high-profile airspace incidents, including a deadly crash between an Army Black Hawk helicopter and a commercial airliner near Ronald Reagan Washington National Airport that January.

    While the project includes some brick-and-mortar upgrades at U.S. airports and related facilities, most of the effort is focused on updating outdated air traffic monitoring and communications systems.

    The One Big, Beautiful Bill, which was signed into law in July 2025, allocated $12.5 billion for the modernization effort. Transportation, however, called that amount a “down payment” that December and said it would need an additional $20 billion for the initiative.

    It remains to be seen what steps will be needed to integrate the administration’s strategy with the air traffic control modernization effort, and whether or not this will have any impact on the project’s timeline.

    The FAA announced in December that it awarded Peraton a $1.5 billion contract to serve as the project’s prime integrator, although Politico reported on Thursday that officials within the agency were growing frustrated by the company’s management of the massive systems overhaul. 

    During an April event, however, Duffy said “we’re on track to have this project completed before President Trump leaves office.”

    When reached for comment, Transportation directed Nextgov/FCW to a Friday press release that announced the agency’s request for public comment on where new space launch facilities should be built, as well as how it should go about setting aside “priority airspace” for future launches. 

    Both Transportation’s request for information and press release, however, did not include any details as to how the space transportation policy would be integrated with the agency’s air traffic control modernization project.

    An FAA spokesperson similarly referenced Transportation's release and said the agency is "seeking input on how increased launch cadence can be integrated into the U.S. airspace system."

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A Democratic lawmaker hopes to include language prescribing large language model containment practices in pending House legislation on artificial intelligence in the wake of the OpenAI models' attack on Hugging Face networks. 

    Rep. Suhas Subramanyam, D-Va., gave updates on the House’s AI-related legislative plans during a Center for Strategic and International Studies event Monday. He said the OpenAI models’ breach from containment environments during routine testing has prompted potential updates to the pending FRONTIER Act, which was introduced in July by Reps. Jay Obernolte, R-Calif., and Lori Trahan, D-Mass. 

    “There's a lot of things that we're trying to fine-tune in the bill, and we're going to be working on that in September,” Subramanyam said. “A lot of what we're doing in the bill is encouraging third parties to be involved with the companies along the way, to make sure there's containment in place. It's assumed in the bill that we're going to be doing a lot on containment, but one of the things I'm going to be working on is trying to see if we can get explicit containment prescription guidelines in the bill to do that.”

    Currently, the bill’s language features risk mitigation efforts that hinge on independent safety evaluations and assessments of the lifecycle of a given model, including training and deployment, along with auditing ongoing compliance efforts. It also explicitly mandates the creation of a vehicle to report critical safety incidents related to AI models.  

    Subramanyam, who on Aug. 10 joined fellow lawmakers in signing a letter asking for OpenAI to disclose more information about the containment breach, said the window for Congress to act is closing.

    “I'm hoping that by the end of the year … we, as a Congress and as a federal government, have at least worked towards solving the big concern about an AI model getting out and going a little crazy and doing a lot of harm to a lot of people,” he said.

    Subramanyam added that he is actively looking for feedback on the best ways to codify containment strategies outside of voluntary participation from large AI developers. 

    Leadership at Hugging Face voiced support for a standardized incident reporting method as well. Ian Reynolds, the AI public policy manager at Hugging Face, also said at Thursday's CSIS event that it would be helpful for lawmakers and policy officials to improve the path to incident reporting on future agentic misalignment.

    “We need better standardized disclosure and transparency requirements in this space to help build broader ecosystem resilience,” Reynolds said. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶