• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a high-severity security flaw impacting Broadcom VMware Tools and VMware Aria Operations to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. The vulnerability in question is CVE-2025-41244 (CVSS score: 7.8), which could be exploited by an attacker to attain

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In an unprecedented cybersecurity incident that occurred in September 2025, over 500 gigabytes of internal data from China’s Great Firewall infrastructure were exposed in what security experts are calling one of the most consequential breaches in digital surveillance history.

    The massive leak encompasses more than 100,000 documents, including internal source code, work logs, configuration files, emails, technical manuals, and operational runbooks from Chinese infrastructure firms associated with the censorship apparatus.

    The exposed material reveals the technical scaffolding behind China’s digital surveillance regime, containing raw IP access logs from state-run telecom providers such as China Telecom, China Unicom, and China Mobile.

    The dataset provides unprecedented visibility into real-time traffic monitoring and endpoint interaction protocols, offering researchers a multidimensional forensic cross-section of the Great Firewall’s operational anatomy.

    Far from being an accidental disclosure, this archive represents a curated corpus likely compiled over an extended period, suggesting either a trusted insider with comprehensive access or a methodical external data exfiltration campaign.

    The breach reveals critical vulnerabilities within China’s distributed enforcement model, exposing moments where the censorship apparatus faltered.

    DomainTools analysts noted that multiple instances of cross-border leakage routes allowed foreign IP addresses to establish unfiltered sessions for extended periods, indicating delays in rule propagation, temporary policy gaps, or failures in heuristic detection systems.

    These lapses demonstrate that while the system maintains high surveillance capabilities, it remains reactive and inconsistently enforced across different regions.

    Among the most sensitive exposed artifacts are packet captures (PCAPs) and routing tables paired with blackhole sinkhole exports, detailing how traffic is intercepted, redirected, or silently dropped.

    Excel spreadsheets enumerate known VPN IP addresses, DNS query patterns, SSL certificate fingerprints, and behavioral signatures of proxy services, providing insight into identification and blocking heuristics.

    The dataset also contains Visio diagrams mapping internal firewall architecture from hardware deployments to logical enforcement chains spanning various ministries and provinces.

    Metadata Exposure and Attribution Tracking

    The leak’s most strategically valuable component lies in the accidentally embedded metadata across thousands of files, offering unprecedented visibility into the human and organizational machinery behind China’s censorship apparatus.

    Network Topology (Source – Domaintools)

    The dump exposes dozens of unique usernames following consistent naming conventions indicative of internal departmental hierarchies, including system-level account names and author tags in Office documents that enable correlation to individual operators.

    Authorship data and revision histories link technical documents to specific personnel across government agencies, telecom subsidiaries, and third-party contractors.

    System Status Network Topology (Source – Domaintools)

    Cross-referencing these metadata fields with known Chinese corporate entities and state-linked research institutes has enabled the construction of preliminary attribution clusters showing clear ties to China’s major telecommunications providers and academic partners, including digital forensics laboratories and infrastructure vendors with suspected MSS connections.

    Multiple files retain internal IP address references and machine hostnames mapped to sandbox and testbed environments used for evaluating censorship evasion tools, including systems specifically tagged for analyzing Psiphon, V2Ray, and Shadowsocks protocols.

    Some remote server addresses and reverse-proxy logs point to Great Firewall staging zones used to pilot domain interdiction and traffic shaping prior to national deployment.

    The organizational fingerprints reveal a complex lattice of state-linked entities operating in tightly controlled silos, with core traffic monitoring and enforcement responsibilities handled by major telecommunications providers whose infrastructure appears repeatedly in PCAP logs, IP registries, and system-level telemetry.

    This breach fundamentally shifts the asymmetry between censor and censored, providing detailed blueprints of China’s digital surveillance infrastructure for the first time in history.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Historic Great Firewall Breach – 500GB+ Censorship Data Exposed appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In a historic breach of China’s censorship infrastructure, over 500 gigabytes of internal data were leaked from Chinese infrastructure firms associated with the Great Firewall (GFW) in September 2025. Researchers now estimate the full dump is closer to approximately 600 GB, with a single archive comprising around 500 GB alone. The material includes more than […]

    The post Massive Great Firewall Leak Exposes 500GB of Censorship Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • WhatsApp has unveiled passkey-encrypted backups, simplifying the protection of cherished chat histories without the burden of memorizing complex passwords.

    This feature allows users to secure their end-to-end encrypted backups using biometric methods like fingerprints, facial recognition, or device screen locks, ensuring seamless access even after losing a phone or switching devices.

    Announced on October 29, 2025, the update addresses a long-standing pain point for the app’s over three billion users, who often store years of photos, voice notes, and conversations in backups on Google Drive or iCloud.​

    Passkeys represent a passwordless authentication evolution, leveraging device-specific biometrics to generate unique cryptographic keys that remain secure on the user’s hardware.

    Unlike the previous system introduced in 2021, which required a custom password or a cumbersome 64-digit encryption key, this new method integrates directly with the phone’s built-in security features for effortless encryption.

    WhatsApp Passkey Encryption for Chat

    Users can now encrypt backups with a simple tap or glance, applying the same robust end-to-end encryption that safeguards live chats and calls against access by WhatsApp, Meta, or third-party cloud providers.

    This innovation not only enhances convenience but also reduces risks associated with forgotten credentials, which previously could lock users out of their data entirely.

    Security experts note that passkeys are more resistant to phishing and credential stuffing attacks than traditional passwords, making them a forward-thinking choice for mobile messaging.​

    With cyber threats escalating, including recent spyware exploits targeting messaging apps, protecting stored data has never been more critical.

    WhatsApp’s encrypted backups ensure that personal memories and sensitive exchanges remain private, even if a device is compromised or stolen. The feature builds on the platform’s pioneering 2021 rollout of end-to-end encryption for backups, which now secures over 100 billion daily messages for two billion users.

    By eliminating reliance on easily lost keys, passkeys democratize advanced security, empowering non-technical users to maintain privacy without compromising on protection.

    This move aligns with broader industry trends toward biometric and zero-knowledge authentication, potentially setting a standard for other apps handling personal data.​

    The passkey encryption will deploy gradually worldwide on iOS and Android over the coming weeks and months, starting with the latest app versions. To enable it, users should navigate to Settings > Chats > Chat backup > End-to-end encrypted backup and select the passkey option.

    WhatsApp encourages immediate updates to stay ahead of the rollout, emphasizing that this enhancement keeps backups as secure and accessible as everyday chats.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post WhatsApp Introduces Passkey Encryption for Enhanced Chat Message Backup Security appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security researchers have uncovered a sophisticated attack vector that exploits how AI search tools and autonomous agents retrieve web content. The vulnerability, termed “agent-aware cloaking,” allows attackers to serve different webpage versions to AI crawlers like OpenAI’s Atlas, ChatGPT, and Perplexity while displaying legitimate content to regular users. This technique represents a significant evolution of […]

    The post New Agent-Aware Cloaking Technique Uses ChatGPT Atlas Browser to Feed Fake Content appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Cybersecurity and Infrastructure Security Agency (CISA), working alongside the National Security Agency and international cybersecurity partners, has released a comprehensive security guidance document focused on hardening Microsoft Exchange servers against evolving threats. The Microsoft Exchange Server Security Best Practices guide aims to help network defenders and IT administrators strengthen their on-premises Exchange infrastructure and […]

    The post CISA Publishes New Guidance to Strengthen Microsoft Exchange Server Security appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated phishing campaign leveraging multilingual ZIP file lures has emerged across East and Southeast Asia, targeting government institutions and financial organizations with unprecedented coordination. Security researchers utilizing Hunt.io’s AttackCapture™ and HuntSQL™ datasets have uncovered an interconnected network of 28 malicious webpages operating across three language clusters, revealing a scalable, automation-driven infrastructure designed to deliver […]

    The post Malicious Multilingual ZIP Files Strike Banks and Government Offices appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A design firm is editing a new campaign video on a MacBook Pro. The creative director opens a collaboration app that quietly requests microphone and camera permissions. MacOS is supposed to flag that, but in this case, the checks are loose. The app gets access anyway. On another Mac in the same office, file sharing is enabled through an old protocol called SMB version one. It’s fast and

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated Linux kernel rootkit designed to slip past the defenses of Elastic Security, a leading endpoint detection and response (EDR) platform.

    Released on GitHub by researcher 0xMatheuZ, the rootkit employs advanced obfuscation techniques to evade YARA-based detection and behavioral monitoring.

    While presented strictly for educational purposes, Singularity underscores the evolving challenges in kernel-level threat detection, potentially informing both attackers and defenders in the cybersecurity arms race.

    Elastic Security, integrated with Elastic Defend, typically triggers over two dozen alerts during rootkit scans, including file quarantines and process terminations.

    Singularity counters this by fragmenting its code, randomizing identifiers, and staging payloads in memory, achieving full evasion during testing.

    Core capabilities include hiding processes from /proc, concealing files and directories with patterns like “singularity” or “matheuz,” masking TCP connections on port 8081, and enabling privilege escalation via custom signals or environment variables.

    It also features an ICMP-based backdoor for reverse shells triggered by specific packet sequences, alongside anti-analysis measures that block tracing and sanitize logs.

    Linux Rootkit Evades Elastic EDR Detection

    At the heart of Singularity’s success lies a multi-layered approach to static analysis evasion. Traditional rootkits falter on predictable strings and symbols that YARA rules target, such as “kallsyms_lookup_name” paired with “license=GPL” or hooks like “hook_getdents.”

    Singularity tool

    The rootkit’s Python-based obfuscator fragments these at compile-time, splitting strings into adjacent literals that the C compiler reassembles—e.g., transforming MODULE_LICENSE(“GPL”) into MODULE_LICENSE(“G” “P” “L”).

    This ensures functionality while rendering the binary’s strings non-contiguous for scanners, as verified by tools like strings and objdump showing no direct matches.

    Symbol name randomization takes it further, replacing suspicious prefixes (“hook_,” “fake_”) with innocuous, kernel-mimicking names like “sys_abjker_handler” or “kern_wopqls_helper.”

    A whitelist protects essential kernel APIs, and regex patterns extract functions for consistent renaming, sorted by length to avoid partial substitutions, MatheuZ said.

    Ftrace hooking functions, another common giveaway, receive similar treatment, renaming “fh_install_hook” to evade rules detecting two or more such patterns. These techniques collectively dismantle the 57 function-name signatures in Elastic’s generic rootkit rules.

    Beyond static tricks, Singularity fragments its compiled .ko file into 64KB XOR-encoded chunks using a random 16-byte key, stored alongside metadata for reconstruction.

    A custom loader, compiled statically, reassembles these in memory via memfd_create, an anonymous file descriptor that avoids disk artifacts.

    It employs direct syscalls (both 64-bit and legacy 32-bit via int $0x80) to invoke finit_module, sidestepping hooked libc functions. This memory-only loading resists on-disk scanning, with fragments deletable post-execution.

    Behavioral detection proves trickier, especially for the ICMP-triggered reverse shell. Elastic flags patterns like setsid with /dev/tcp/ in command lines or shell executions from kernel workers.

    Singularity counters by writing a staged bash script to /singularity, hiding the spawning kworker PID immediately, then executing a clean /bin/bash /singularity.

    The script opens a TCP descriptor, spawns sh in the background, and uses kill -59 on precise PIDs for targeted hiding and escalation, bypassing command-line scrutiny without affecting legitimate processes.

    Evades security Detection
    Evades security Detection

    Bonus evasions include compiling loaders in /tmp instead of monitored /dev/shm and automating the obfuscation pipeline for reproducibility. In tests, Singularity loaded undetected, hid processes, and established root shells, proving its mettle against current Elastic rules.

    This work highlights the fragility of signature-based defenses against adaptive threats. As EDRs evolve, such research pushes for holistic detection blending machine learning and anomaly analysis. For defenders, it signals the need for deeper kernel integrity checks; for researchers, it’s a blueprint for resilience.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Researchers Created a Linux Rootkit that Evades Elastic Security EDR Detection appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The morning after President Donald Trump vowed to “start testing our Nuclear Weapons,” his pick to lead U.S. Strategic Command fielded questions from senators who wondered what the president meant and what the nominee planned to do about it.

    “If confirmed in the role of the STRATCOM commander, my role would be to provide military advice, and I would look forward to working with the committee and policy members to inform the way ahead with respect to any testing, whether that's testing of our missile systems, or maturity associated with surety” of nuclear weapons, said Vice Adm. Richard Correll, a submariner and STRATCOM’s deputy commander.

    That was the gist of Correll’s testimony during his confirmation hearing Thursday as lawmakers tried to parse exactly what Trump meant when he called for immediate nuclear weapons testing “on an equal basis” via social media late on Wednesday. No one was quite sure what the president meant, but it’s been 33 years since the United States exploded a nuclear weapon. 

    Trump defended his position to reporters Thursday aboard Air Force One returning from a trip to Asia. 

    “We have more nuclear weapons than anybody. We don't do testing. We've halted it years, many years ago. But with others doing testing, I think it's appropriate that we do also,” he said.

    Last year, a nuclear weapons scientist from Los Alamos National Laboratory told NPR that "our assessment is that there are no system questions that would be answered by a test, that would be worth the expense and the effort and the time.”

    The president didn’t provide details on when or where testing would take place but said, “We have test sites; it'll be announced.”

    Robert Peters, a senior research fellow for strategic deterrence at the Heritage Foundation, told NPR that there was just one place where the U.S. could test a nuke: the Nevada National Security Site, about 60 miles northwest of Las Vegas.

    Back on Capitol Hill, senators, mostly Democrats, looked to Correll for clear answers on how he would advise the president on explosive nuclear testing or how its resumption could influence adversaries like China and Russia. 

    Sen. Jack Reed, D-R.I., ranking member of the Senate Armed Services Committee, lambasted Trump’s “confusing” policy change during the hearing and in a statement, calling it a "fundamental misunderstanding of our nuclear enterprise—it is the Department of Energy, not the Department of Defense, that manages our nuclear weapons complex and any testing activities.”

    “The United States would gain very little from such testing, and we would sacrifice decades of hard-won progress in preventing nuclear proliferation," Reed said in a statement.

    During the hearing, Sen. Mazie Hirono, D-Hawaii, worried such live testing would “push” nuclear power nations to test more.

    “We have a Stockpile Stewardship Program to ensure the safety and reliability of our nuclear weapons without explosive testing, and the program relies on supercomputer simulations, non-explosive experiments and technology. We have a lot of technology that keeps us ahead of our adversaries in terms of ensuring that our nuclear stockpile is actually reliable,” she said.

    Sen. Jacky Rosen, D-Nev., stressed the lasting effects of explosive nuclear testing. 

    “The Nevada Test Site, now known as the Nevada National Security Site, NNSS, was ground zero for the majority of the United States, explosive nuclear testing from 1951 to 1992…and my state of Nevada is still suffering the consequences,” Rosen said. “I will not let this happen, not on my watch. I will do everything I can in my power as a senator, as a United States citizen, to put a stop to this and protect families in my State of Nevada.”

    Correll said he “wouldn't presume to predict a response on the part of Russia or China” and as the hearing went on, vowed to provide data-informed advice on nuclear weapons testing, while also requesting classified meetings to answer senators’ concerns. 

    “I have always been driven by data and, to the best of my ability, provide forthright and candid advice. And I commit that that will not change going forward,” he said.

    Correll also supports the Stockpile Stewardship Program, “which has developed the science and tools necessary to certify the nuclear weapons stockpile without the need for full-scale nuclear weapons testing,” according to written responses to policy questions, 

    Republican senators were more tempered in their questioning, supporting the president’s statement by emphasizing the need for all kinds of nuclear testing on a regular schedule.

    Sen. Tim Sheehy, R-Mont., said “testing on an ‘equal basis,’ is an extremely reasonable ask of our military, and I think it's the least we can do.” 

    “In general, tests of all kinds, whether nuclear or conventional, don't just provide those benefits, but also can send a strong message of resolve and deterrence,” said Sen. Tom Cotton, R-Ark., “We saw the exact opposite effect at times during the last administration, when President Biden canceled routine tests of our Minutemen III missiles to avoid supposedly escalating tensions with China or Russia.”

    When asked about maintaining a nuclear testing schedule as a means of deterrence, Correll agreed. 

    The STRATCOM commander role is “responsible for the requirements associated with accuracy and effectiveness of the weapons and that then drives the services and other subject matter experts, analysis of the testing required to meet those objectives,” he said. “It is a really, really important aspect of demonstrating the reliability and credibility of our nuclear deterrent, and that's an essential attribute for deterrence…particularly in this era.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶