• A critical Local Privilege Escalation flaw has been uncovered within the Linux kernel, allowing unprivileged local users to seamlessly gain root access by manipulating the system’s page cache. This vulnerability, designated as CVE-2026-43503, represents a severe gap in the XFRM/IPsec subsystem’s packet-processing path that bypasses earlier mitigations. By exploiting this flaw, attackers can execute a […]

    The post Linux Kernel DirtyClone Vulnerability Lets Local Attackers Gain Root Privileges appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical security flaw discovered in the Amazon Q Developer Extension for Visual Studio Code (VS Code) left developers vulnerable to arbitrary code execution and cloud credential theft. Tracked as CVE-2026-12957 and CVE-2026-12958, these high-severity vulnerabilities highlight significant risks in how AI coding assistants manage trust boundaries. The root cause of this vulnerability lies in […]

    The post Amazon Q Developer Vulnerability Allows Code Execution via Malicious Repositories appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Compare 8 top SAST tools for polyglot monorepos, covering incremental scans, ownership, custom rules and platform engineering at scale 2026.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Army’s proliferating drone use is exacerbating the modern problem of keeping everything charged. One combat team is testing ways to use its light Infantry Squad Vehicles as mobile charging stations.

    “As we field technology, power generation becomes increasingly problematic. The [Integrated Tactical Network], all the soldier-borne equipment, all require batteries that have to be recharged. [Enhanced Night Vision Goggles] require batteries, particularly to use thermals,” said Col. Ryan Bell, commander of the 3rd Mobile Brigade Combat Team in the 101st Airborne Division, of lessons from an April training rotation at the Joint Readiness Training Center at Fort Polk, Louisiana. 

    Finding ways to boost battery power on the battlefield—and learning how long new tech lasts in different conditions—is a persistent problem for the military. 

    “As we add drones…the [Short Range Reconnaissance], the [Medium-Range Reconnaissance], they all have to be charged,” Bell told reporters Thursday. 

    So the unit equipped its ISVs with inverters, similar to the kind of thing any car owner might plug into the outlet formerly known as a cigarette lighter to get standard 120V power.

    “Every squad functionally had their own generator without having to tow a trailer, or a generator, behind it,” Bell said.

    But more power is needed, he said, like hybrid generators that could deliver up to 10 kilowatts, depending on a unit’s needs. 

    Bell suggested sizing the generators so they can be mounted on the five-seater ISV-Utility variant the Army plans to field. They could also be towed, but that’s not a great solution for rough terrain. 

    The Senate’s version of the 2027 defense policy bill would greenlight multiyear procurement of the ISVs if adopted in the final version. 

    “As future ISVs are fielded, we need to ensure they are utilized as power generation platforms, particularly for our squads. Our use of the vehicle as a sustainment platform by adding commercial off-the-shelf racks on the back was very helpful,” Bell said. 

    “We are also excited to get the ISV-U, which will give us more utility lift capacity. Having a single, common platform across the formation will simplify our logistics chain. The utility variant will be extremely helpful for mission command and power generation for our command posts.”

    Bell also said troops also need batteries that carry more charge and last longer, which would “reduce the number of batteries you have to charge and have to carry, because solder load is a real thing.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The FBI and CISA have updated their March warning about Russian intelligence phishing Signal accounts, and the operators have added a step: they now coax targets into handing over their Signal Backup Recovery Key. Hand it over once, and the attacker can restore the account’s backup, read the private and group message history, and take over the account. Worse, the key keeps working.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Woodgnat Hackers use Backdoor.Mistic, a stealthy RAT, to let brokers compromise networks and sell entry points to ransomware groups, putting firms at risk.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts. Kaspersky, which is tracking the activity under the moniker StrikeShark, said the campaign has targeted a diplomatic organization in Indonesia, government organizations in Taiwan,

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A Chinese-speaking advanced persistent threat (APT) actor has been linked to a new custom backdoor called TinyRCT as part of cyber attacks aimed at government entities and critical infrastructure in Southeast Asia. The activity, particularly aimed at state-owned enterprises in the energy and government sectors, has been attributed to a threat actor called CL-STA-1062, which Palo Alto Networks

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer’s cloud credentials. The path was short: a developer opens the repo, trusts the workspace, and Amazon Q does the rest. Amazon has patched it. Tracked as CVE-2026-12957 (CVSS 8.5), the bug sat in how Amazon’s AI coding assistant handled Model Context Protocol (MCP) servers. Wiz

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A flaw in the Linux kernel’s traffic-control subsystem can let a local unprivileged user gain root on affected systems. CVE-2026-46331, nicknamed “pedit COW,” is an out-of-bounds write in the packet-editing action (act_pedit) that corrupts shared page-cache memory. A public, working exploit appeared within a day of the CVE assignment on June 16. Red Hat rates the flaw as

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶