• Microsoft has disclosed two critical zero-day vulnerabilities in the Agere Modem driver bundled with Windows operating systems, confirming active exploitation to escalate privileges.

    The flaws, tracked as CVE-2025-24990 and CVE-2025-24052, affect the ltmdm64.sys driver and could allow low-privileged attackers to gain full administrator access.

    These issues were patched in the October 2025 cumulative update, but Microsoft warns that affected fax modem hardware will cease functioning post-update.

    Vulnerabilities Exposed In Legacy Driver

    The Agere Modem driver, a third-party component shipped natively in Windows, has long been a dormant risk.

    CVE-2025-24990 stems from an untrusted pointer dereference (CWE-822), enabling attackers to manipulate memory and bypass security boundaries.

    With a CVSS 3.1 score of 7.8, it requires only local access and low privileges, yet yields high impacts on confidentiality, integrity, and availability.

    Microsoft’s threat intelligence team, MSTIC, along with researchers from r-tec IT Security and an anonymous contributor, identified exploitation in the wild.

    The second flaw, CVE-2025-24052, involves a stack-based buffer overflow (CWE-121), scoring 7.8 on CVSS. Publicly disclosed with proof-of-concept code available, it poses a similar threat but has not yet been observed in active attacks.

    Both vulnerabilities persist even without active modem use, affecting all supported Windows versions from Windows 10 onward. Attackers need not interact with hardware; a simple local exploit suffices to elevate rights.

    CVE IDDescriptionCVSS ScoreExploit StatusWeakness
    CVE-2025-24990Untrusted Pointer Dereference in ltmdm64.sys7.8 (Important)Actively Exploited (Functional PoC)CWE-822
    CVE-2025-24052Stack-based Buffer Overflow in ltmdm64.sys7.8 (Important)Proof-of-Concept AvailableCWE-121

    No indicators of compromise (IoCs) were detailed in disclosures, but Microsoft urges scanning for ltmdm64.sys presence.

    These zero-days highlight the dangers of legacy drivers in modern ecosystems. An attacker with an initial foothold, perhaps via phishing or malware, could load the vulnerable driver and execute code to impersonate admins.

    In enterprise settings, this escalates to domain control, data exfiltration, or ransomware deployment. Fabian Mosch from r-tec noted that exploits target driver loading during system boot or service calls, evading user-mode defenses.

    The proof-of-concept for CVE-2025-24990 involves crafting malformed input to the driver’s IOCTL handler, which triggers the dereference of a controlled pointer.

    For CVE-2025-24052, overflow exploits stack corruption via oversized buffers in modem emulation routines. Researchers demonstrated privilege jumps from standard user to SYSTEM level without crashes.

    Microsoft’s Response And User Guidance

    In the October Patch Tuesday release, Microsoft removed ltmdm64.sys entirely, rendering dependent Agere modems obsolete. Users reliant on fax hardware must seek alternatives, as no backward compatibility exists.

    The company advises immediate patching and auditing for the driver via tools like Autoruns. For unpatched systems, disable the driver through Device Manager or group policy.

    This incident underscores the need to phase out outdated components. Cybersecurity experts recommend endpoint detection rules for anomalous driver loads and regular vulnerability scans.

    As exploitation continues, organizations should prioritize these fixes to thwart privilege escalation chains.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Windows Agere Modem Driver 0-Day Vulnerabilities Actively Exploited To Escalate Privileges appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft on Tuesday released fixes for a whopping 183 security flaws spanning its products, including three vulnerabilities that have come under active exploitation in the wild, as the tech giant officially ended support for its Windows 10 operating system unless the PCs are enrolled in the Extended Security Updates (ESU) program. Of the 183 vulnerabilities, eight of them are non-Microsoft

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Sophisticated Threat Actor Compromises 17,000+ Developers Through Trojan Extensions That Steal Code and Mine Cryptocurrency. Operating since early 2025 under multiple publisher accounts (ab-498, 498, and 498-00), this sophisticated campaign deploys extensions that steal source code, mine cryptocurrency, and establish remote backdoors for complete system control. A newly identified threat actor known as TigerJack has […]

    The post TigerJack Hackers Target Developer Marketplaces with 11 Malicious VS Code Extensions appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Fortinet has disclosed a security vulnerability affecting its FortiOS operating system that could allow attackers with administrative privileges to execute unauthorized system commands by bypassing command line interface restrictions. The flaw, tracked as CVE-2025-58325, was discovered internally by Fortinet’s PSIRT team and published on October 14, 2025. Vulnerability Details The security weakness stems from an […]

    The post FortiOS CLI Bypass Flaw Lets Attackers Run Arbitrary System Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The United Kingdom faces an unprecedented cyber security crisis as the National Cyber Security Centre (NCSC) reports handling an average of four ‘nationally significant’ cyber attacks weekly.

    This alarming escalation represents a dangerous shift in the threat landscape, with the NCSC managing 204 nationally significant incidents in the twelve months ending August 2025, more than doubling from 89 attacks recorded in the previous year.

    The threat environment has reached critical proportions, with 18 incidents classified as ‘highly significant’ during the reporting period.

    These attacks carried the potential for severe disruption to essential services and infrastructure, marking an almost 50% increase from the previous year and continuing a three-year upward trend.

    The NCSC’s latest Annual Review reveals that over half of all 429 incidents handled required national-level coordination, underscoring the systematic nature of these threats against UK interests.

    A substantial proportion of these attacks originated from Advanced Persistent Threat (APT) actors, including both nation-state operatives and sophisticated criminal organizations.

    National Cyber Security Centre (NCSC) analysts noted the increasing complexity and persistence of these threat actors, who demonstrate advanced capabilities in targeting critical infrastructure, government systems, and private sector networks.

    The attacks have demonstrated significant impact potential across the UK’s national security apparatus, economic systems, and essential service providers.

    Dr Richard Horne, NCSC Chief Executive, emphasized that cyber security has evolved into a matter of business survival and national resilience.

    The escalating threat demands immediate action from business leaders, as hesitation represents a fundamental vulnerability that attackers readily exploit.

    Government Response and Industry Collaboration

    The severity of the situation has prompted direct government intervention, with official correspondence sent to chief executives and chairs of major UK businesses, including all FTSE350 companies.

    This coordinated approach aims to establish cyber resilience as a board-level responsibility while fostering collaboration between government and private sector entities.

    The NCSC has simultaneously launched the Cyber Action Toolkit, specifically designed to assist small organizations in implementing foundational security controls against common threats.

    The initiative includes promotion of the Cyber Essentials certification scheme, which provides automatic cyber liability insurance for qualifying UK organizations with annual turnover below £20 million, creating financial incentives for proper security implementation across the business landscape.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post NCSC Warns of UK Experiencing Four Cyber Attacks Every Week appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The defense industry must produce counterdrone technology quickly—and in high numbers—to stay ahead of a potential drone threat. But delicate supply chains can make it harder for some companies to meet demand—even if their tech meets the Army’s needs. 

    “I have a lot of niche capabilities that are out there, but we may be challenged in scaling from an industrial perspective,” Col. Marc Pelini, who leads the Army’s air and missile defense cross-functional team, said during a counterdrone panel at the Association of the U.S. Army’s annual conference Monday.

    “If you look at some of the open source reporting on what's been going on in Ukraine and Russia the last few months—I think this figure I saw, in August, the Russians used up to 30,000 first person view drones. So, the scale is absolutely one of the most critical elements, which gets to some of the other comments about being able to try multiple different approaches to be able to attack it from different vectors,” said Brig. Gen. Glenn Henke, commandant for U.S. Army Air Defense Artillery and deputy commanding officer for Fort Sill’s Fires Center of Excellence.

    Eprius, which makes a series of high-powered microwave non-kinetic weapons, is acutely aware of how hard high-output production is, especially with supply chain constraints around high-powered amplifiers. But Andy Lowery, Epirus’ CEO, wants to be ready once the Army and other government customers decide on a program of record for counterdrone tech. 

    “Primarily this year has been about a year preparing to scale,” he said. “That is a major problem for us.”

    The company, which has a manufacturing plant in Torrance, Calif., wants to expand capacity with a new facility that Lowery hopes to announce a final location for in the summer of 2026. But in the nearterm, Epirus is leaning on its partnership with General Dynamics to double production ability. 

    “We've got seven systems in progress right now. But if 70 were to be the ask? One of our systems has 148,000 parts in it—15,000 are build-to-print, 135,000 are commercial-off-the-shelf. It is not easy to swing from seven to 70,” Lowery previously told Defense One.

    The details aren’t completely ironed out, but the goal is to have General Dynamics, which Epirus teamed up with for a manned and unmanned version of its high-powered microwave, do a lot of the metal work. 

    “As a manufacturing prime, we have substantial capacity to produce and ramp up at scale manufacturing of new equipment. Early on, our partnership with Epirus was far more just in the lines of ‘Hey, they had a powerful capability that they thought would integrate onto our Stryker,’” 

    G. Scott Taylor, who leads business development for General Dynamics Land Systems, told Defense One. “We would build a lot of the framework around it, and they would continue and focus on building the [line replaceable amplifier modules] themselves.” 

    If successful, Lowery hopes to replicate the model regionally, letting prime defense contractors do the “heavy lifting” more locally. 

    Established defense contractors partnering with newer companies isn’t new, but could become increasingly necessary as the Pentagon encourages more contracts with non-traditional companies that may not have the experience or capacity to make high quantities of what the military needs.  

    “If you didn't already have the factory, a lot of these guys are saying, ‘Why do I want to build my own factory…So we step in at times,” even for larger companies like Boeing or Viasat, when “there's synergy with our product line or with our customer base,” said Mike Sheehan, president and CEO for Thales Defense & Security, Inc.  and security. 

    Besides doing metalwork, bigger contractors can shoulder some of the certification requirements, like auditable accounting systems. 

    “One sort of ironic thing about your traditional defense companies, and then your non-traditional defense companies: traditional defense contractors need to be certified. [Your] cost accounting system needs to be certified; you get audited regularly. DCMA, DCAA, they monitor your rates. They limit how much profit you can make on fixed-price jobs and all that. And it's a tremendous amount of work and overhead on both the government side and industry side to keep that going.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The GhostBat RAT campaign leverages diverse infection vectors—WhatsApp, SMS with shortened URLs, GitHub-hosted APKs, and compromised websites—to distribute malicious Android droppers. Once installed, these droppers employ multi-stage workflows, deliberate ZIP header manipulation, and heavy string obfuscation to evade antivirus detection and reverse‐engineering. The threat actors utilize native libraries (.so) to dynamically resolve API calls and […]

    The post GhostBat RAT Android Malware Poses as Fake RTO Apps to Steal Banking Data from Indian Users appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft has disclosed a critical remote code execution flaw in its Internet Information Services (IIS) platform, posing risks to organizations relying on Windows servers for web hosting.

    Tracked as CVE-2025-59282, the vulnerability affects the Inbox COM Objects handling global memory, stemming from a race condition and use-after-free error.

    Announced on October 14, 2025, it carries a CVSS 3.1 base score of 7.0, rated as “Important” by Microsoft.

    While not yet exploited in the wild, security experts warn that its potential for arbitrary code execution could enable attackers to compromise server integrity, steal data, or pivot to broader network attacks.

    The flaw arises during concurrent execution where shared resources lack proper synchronization, allowing an unauthorized attacker to manipulate memory states.

    According to the CVE details, exploitation requires local access but can originate from a remote adversary who tricks a user into opening a malicious file.

    No privileges are needed, though the high attack complexity demands winning a precise race condition, making it challenging yet feasible for skilled threat actors.

    Microsoft IIS Vulnerability

    At its core, CVE-2025-59282 exploits weaknesses in CWE-362 (race condition) and CWE-416 (use-after-free) within IIS’s COM object management.

    When a user interacts with a crafted file, such as a specially malformed document or script, the vulnerability triggers improper memory handling.

    This leads to a use-after-free scenario where freed memory is accessed concurrently, enabling code injection.

    The CVSS vector string, CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, highlights key factors: local attack vector, high complexity, required user interaction, and high impacts across confidentiality, integrity, and availability.

    Microsoft clarifies that “remote” in the title refers to the attacker’s position, not the execution site, distinguishing it from fully remote exploits.

    No proof-of-concept code has been publicly released, but researchers note similarities to past IIS memory issues, where attackers could escalate to system-level control.

    Affected versions include Windows Server editions with IIS enabled, though Microsoft has not specified exact builds in initial advisories.

    Successful exploitation could allow attackers to run arbitrary code with the privileges of the IIS process, often running as SYSTEM on misconfigured servers.

    In enterprise environments, this might expose sensitive web applications, databases, or API endpoints to ransomware deployment, data exfiltration, or lateral movement.

    For instance, a compromised IIS server in a corporate intranet could serve as an entry point for advanced persistent threats targeting financial or healthcare sectors.

    Given the “Exploitation Unlikely” assessment from Microsoft’s MSRC, immediate threats remain low. However, the lack of patches at disclosure time urges urgent updates.

    No indicators of compromise (IoCs) have been detailed yet, but monitoring for unusual COM object interactions or memory anomalies in IIS logs is advised.

    Mitigations

    The simplest defense is disabling IIS if unused, as unaffected systems face no risk. Microsoft recommends applying forthcoming patches via Windows Update and restricting file execution policies.

    Enabling User Account Control (UAC) and auditing COM interactions can further harden defenses.

    Security firm researchers, including acknowledgers Zhiniang Peng from HUST and R4nger from CyberKunLun, emphasize timely patching to prevent escalation.

    As IIS powers millions of web servers, this vulnerability underscores the need for vigilant memory-safe coding in legacy components. Organizations should scan environments and review web server configurations promptly.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft IIS Vulnerability Allows Unauthorized Attacker To execute Malicious Code appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The China-backed advanced persistent threat group Flax Typhoon maintained year-long access to an ArcGIS system by turning trusted software into a persistent backdoor—an attack so unique it prompted the vendor to update its documentation. The attackers repurposed a legitimate Java server object extension into a web shell, gated access with a hardcoded key, and embedded […]

    The post Chinese Hackers Use Geo-Mapping Tool for Year-Long Persistence appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have disclosed two critical security flaws impacting Red Lion Sixnet remote terminal unit (RTU) products that, if successfully exploited, could result in code execution with the highest privileges. The shortcomings, tracked as CVE-2023-40151 and CVE-2023-42770, are both rated 10.0 on the CVSS scoring system. “The vulnerabilities affect Red Lion SixTRAK and VersaTRAK

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶