• A proof-of-concept has been published that bypasses Microsoft’s mitigation for the NTLM reflection vulnerability tracked as CVE-2025-33073 and allows escalation to NT AUTHORITY\SYSTEM on Windows Server. The exploit leverages two conceptual weaknesses left unaddressed by the original patch: the mitigation was limited to the SMB client path, and recent SMB features let attackers coerce privileged […]

    The post PoC Released for NTLM reflection bypass Vulnerability that Emanbles SYSTEM Access on Windows Server appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The FIFA World Cup 2026 opened on June 11. By that date, according to Check Point Research, the fraud infrastructure targeting it had already been built, staged, and partially deployed. Threat actor activity was pre-planned, months out, across three sectors and at least ten languages. Check Point Exposure Management published the FIFA World Cup 2026 Cyber Threat Report this month, covering

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Army’s 8th Theater Sustainment Command is using artificial intelligence “to help us make better-informed decisions” for supply chain management in the Pacific, the unit’s commander said Friday.

    “For logistics, a lot of what we do is very similar to what the commercial world does, and so I have leveraged, and we are leveraging commercial partners with, you know, how do they do warehouse management regionally, and then how do they look at, how do you time delivery of supplies to the location it’s needed, and kind of, what are those time-distance factors,” Maj. Gen. Gavin Gardner told reporters. “ I’m looking at partners, and I’m talking to partners that do that on a global scale, because the distances between the continental United States to the forward positions that we train or live at, like the Republic of Korea or Japan, we’re constantly looking for smarter ways to do that.”

    “When resources are not unlimited, how do you best look at demand analysis over time and space, and stock forward the right things versus stocking everything? Because we just can’t afford to do that,” he said. “And so we’re using AI right now to help us see that.”

    The command is also already using “very capable” autonomous watercraft in the Pacific and is working with industry to develop and test larger and faster vessels, Gardner said.

    “We have industry partners that are creating vessels right now in the water that are over 100 feet long that would move anywhere between four and eight 20-foot equivalent units… think the containers you see moving up and down most of your ports today,” he said. “That capability is already in play, and it’s going through experimentation now, and the 8th TSC, along with the rest of the United States Army, is looking to partner, test, and innovate those autonomous watercraft first out in our region, because if you can work in the Pacific, you can work anywhere in the world.”

    But the rules will need to evolve to keep up. Current U.S. maritime laws require a minimum crew size for vessels, limiting autonomous operations to testing or pilot programs for commercial use.

    “We need to get the laws of the sea that our Coast Guard currently use to mandate watercraft operations that currently have to be manned when it enters into a port, that we’re comfortable having unmanned systems enter into ports, so that we can rapidly receive and download autonomous watercraft like we do manned watercraft today,” Gardner added.

    Gardner said he’d also eventually like to see “anywhere between 30 and 100” medium-sized autonomous vessels in the U.S. Indo-Pacific theater, “berthed up everywhere from Korea to Japan, the Philippines, Australia, Singapore, Thailand,” to help meet the “constant demand for Army watercraft time now to deliver equipment and supplies in the theater.”

    The unit has one Maneuver Support Vessel (Light), a manned landing craft that will eventually replace the Vietnam-era Landing Craft Mechanized-8, and has been testing it for about nine months to get data to shape the future design of the vessel. The vessel is nearly four times faster than the older watercraft, and much smaller—but also “much more capable” of operating in shallower water, Gardner said.

    “So I’m actually going to different sets of beaches, and so you can put up to two HIMARS onto an MSV-Light, approach a beach very rapidly, bring it into position, download it, and then those platforms can get off and do their fire missions,” he said. “We’ve rehearsed this quite a bit with both the 25th Infantry Division and the 3rd Multi-Domain Task Force,” and have also put multiple Marine NMESIS anti-ship systems onto the vessel for “rapid insertions.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn Stealer. The intrusion involves the exploitation of CVE-2026-48558 (CVSS score: 10.0), a critical authentication bypass vulnerability impacting the OpenID Connect (OIDC) flow that an unauthenticated

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • SystemBC (also tracked as Coroxy) remains a versatile and persistent Windows malware family that operators routinely deploy to convert compromised hosts into SOCKS5 proxy gateways and to maintain remote access for follow-on operations. First observed as a payload in exploit kits around 2018–2019, SystemBC has evolved into a widely traded commodity tool used by multiple […]

    The post SystemBC Malware Turns Windows Machines Into SOCKS5 Proxies for Ransomware Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • WhatsApp is letting users reserve usernames before its 2026 launch, giving people a way to chat without sharing phone numbers. Here is how it works, why it matters, and the security limits to know

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Kali Linux 2026.2 arrives on schedule in the final week of Q2 with a pragmatic blend of desktop environment refreshes, infrastructure hardening, and practical usability refinements that will matter to both pentesters and platform maintainers. The release emphasizes polish and performance rather than headline-grabbing features: GNOME advances to version 50 and KDE Plasma to 6.6. […]

    The post Kali Linux 2026.2 Release With new Hacking Tool and With Updated Desktop Environments appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The new “Boss Scam” is a sharp escalation in CEO fraud: attackers now combine impersonation, Windows DLL sideloading, and WhatsApp Web session theft to turn trusted executive channels into fraud infrastructure. The campaign was highlighted in advisories tied to India’s I4C and NCTAU, which warned that attackers pose as regulators or senior bosses, deliver malicious […]

    The post Boss Scam Uses DLL Sideloading to Hijack WhatsApp Web and Defraud Enterprises appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Two researchers have found six security flaws in AirDrop and Quick Share, the wireless features that beam files between nearby devices with no cables or shared network. An attacker within wireless range, with just a laptop and no prior connection, can crash the sharing service on a Mac or iPhone set to receive from anyone, with no tap or prompt. The same research found Quick Share flaws that

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Convince an AI browser that it is playing a game, and it can hand over your login details. That is the finding behind BioShocking, a technique from security firm LayerX that tricked six AI browsers and assistants into copying a user’s credentials and sending them to an attacker. The targets included OpenAI’s ChatGPT Atlas, Perplexity’s Comet, and Anthropic’s Claude browser extension. An

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶