ADMIN.FOUNDATION – Page 54 – cybersecurity / defense / intelligence

Multiple cPanel & WHM Vulnerabilities Enable Root Code Execution and Admin Session Hijacking

·

CVE/vulnerability, cyber security, Cyber Security News, Vulnerabilities, vulnerability

cPanel has released security updates to address three vulnerabilities in cPanel & WHM that could allow attackers to hijack WHM administrator sessions or execute commands as the root user. Organizations using affected deployments should prioritize upgrades, as these flaws affect all supported versions of cPanel & WHM before the newly released fixed versions. cPanel & […]

The post Multiple cPanel & WHM Vulnerabilities Enable Root Code Execution and Admin Session Hijacking appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Capacitor Vulnerability Lets Remote Content Run With Full App Origin Trust

·

CVE/vulnerability, cyber security, Cyber Security News, vulnerability

A critical vulnerability in Capacitor, identified as CVE-2026-103922, could allow attacker-controlled remote content to execute within vulnerable Android and iOS applications, posing as the application’s own trusted origin. This flaw, assigned a CVSS score of 9.3, affects WebView navigation handling in Capacitor and can expose same-origin data, cookies, local storage, and native functionality available through […]

The post Capacitor Vulnerability Lets Remote Content Run With Full App Origin Trust appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
OpenAI Blocks 15,000 Requests Trying to Extract Protected Model Reasoning

·

cyber security, Cyber Security News, OpenAI

OpenAI has disrupted a coordinated campaign to extract protected internal reasoning from its AI models on a large scale. The company took action against activity linked to more than 15,000 user accounts. The company described the operation as an adversarial model-distillation effort, in which attackers systematically sought model outputs or reasoning traces that could help […]

The post OpenAI Blocks 15,000 Requests Trying to Extract Protected Model Reasoning appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Hackers Are Turning Trusted Software Updates Into Credential-Stealing Malware

·

cyber security, Cyber Security News, Malware

A growing wave of supply-chain attacks is proving the opposite: attackers are compromising legitimate open-source packages and using trusted update channels to deploy credential-stealing malware directly into developer and enterprise environments. Malicious Nx releases, published after attackers stole an npm publishing token through a GitHub Actions workflow flaw, ran post-install scripts that searched systems for […]

The post Hackers Are Turning Trusted Software Updates Into Credential-Stealing Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
TIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft Attacks

·

AWS, cyber security, Cyber Security News, Wordpress

A credential-collection toolkit dubbed TIKTOUK that combines WordPress reconnaissance, exposed-file harvesting, plugin credential decryption, and JavaScript secret scanning. The toolkit consists of two Python scripts, wp2s_poll.py and wp2s_crack.py, alongside a stripped Go-based Linux crawler named jscrawl-amd64. All three components retrieve targets from a central HTTP hub, execute assigned collection tasks, and submit status reports and […]

The post TIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Authentication Bypass Successfully Impersonated 95 Users Without Passwords or MFA

·

cyber security, Cyber Security News

A critical authentication bypass that enabled the impersonation of 95 employee accounts, including privileged users, without passwords, multi-factor authentication (MFA), or valid Microsoft Entra ID tokens. The issue stemmed from two flaws in the application’s custom session-cookie implementation: a predictable hard-coded signing secret and the use of public database identifiers as authenticated session payloads. Although […]

The post Authentication Bypass Successfully Impersonated 95 Users Without Passwords or MFA appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Milk Dragon Phishing Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass MFA

·

cyber security, Cyber Security News, FACEBOOK, Phishing, TikTok

A phishing-as-a-service operation dubbed Milk Dragon, also known as NaiLong, is abusing discount-themed Facebook and TikTok posts to steal payment-card data and intercept multi-factor authentication (MFA) challenges. Group-IB identified 258 phishing pages linked to the kit since October 2025, with victims across 66 countries. Rather than relying on classic delivery-failure notices, bank alerts, or account-lockout […]

The post Milk Dragon Phishing Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass MFA appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
12 Best SSO Solutions Compared (2026): Features & Pricing

·

Cyber Security News, Top 10

Microsoft Entra ID is the best SSO for M365-licensed organizations bundled economics end most debates while Okta is the best neutral anchor for mixed-SaaS estates, with Auth0 (an Okta product line, not a separate vendor) leading developer login. Evaluating these platforms alongside the top enterprise Single Sign-On (SSO) solutions reveals how modern access control has […]

The post 12 Best SSO Solutions Compared (2026): Features & Pricing appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Windows 11 26H2 Enables Settings Backup by Default for Eligible Devices

·

cyber security, Cyber Security News, Microsoft, Windows

Microsoft has automatically enabled Windows settings backup for eligible commercial devices running Windows 11, version 26H2. Microsoft positions this capability as a vital resilience measure for enterprise endpoint recovery. The change is applicable when organizations have left the relevant backup policy in a “Not Configured” state. Administrators’ decisions to explicitly turn the feature on or […]

The post Windows 11 26H2 Enables Settings Backup by Default for Eligible Devices appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
12 Best IGA Tools Compared (2026): Features & Pricing

·

Cyber Security News, Top 10

SailPoint remains the best overall IGA platform for certification depth and AI-assisted reviews, with Saviynt the best converged alternative when ERP-grade SoD must ship cloud-native. Evaluating the broader landscape across the top Identity and Access Management (IAM) companies shows how access governance has evolved from static audit checklists into dynamic risk-control planes. The market’s real […]

The post 12 Best IGA Tools Compared (2026): Features & Pricing appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶