-
The world of enterprise technology is undergoing a dramatic shift. Gen-AI adoption is accelerating at an unprecedented pace, and SaaS vendors are embedding powerful LLMs directly into their platforms. Organizations are embracing AI-powered applications across every function, from marketing and development to finance and HR. This transformation unlocks innovation and efficiency, but it also
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Stormshield CTI researchers have identified two active phishing servers linked to APT35, revealing ongoing credential-stealing operations targeting government and military entities. In an active threat-hunting operation, Stormshield’s Cyber Threat Intelligence (CTI) team discovered two malicious servers exhibiting hallmark characteristics of APT35 infrastructure. These servers, mirroring footprints documented by Check Point, are hosting phishing pages designed […]
The post APT35 Hackers Targeting Government and Military to Steal Login Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A Chinese national has been convicted for her role in a fraudulent cryptocurrency scheme after law enforcement authorities in the U.K. confiscated £5.5 billion (about $7.39 billion) during a raid of her home in London. The cryptocurrency seizure, amounting to 61,000 Bitcoin, is believed to be the single largest such effort in the world, the Metropolitan Police said. Zhimin Qian (aka Yadi Zhang),
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Organizations using VMware hypervisors face an urgent threat as a local privilege escalation zero-day, tracked as CVE-2025-41244, is under active exploitation in the wild. Both VMware Tools and VMware Aria Operations’ Service Discovery Management Pack (SDMP) are affected, enabling unprivileged users to achieve root-level code execution without authentication. The vulnerability has been weaponized by the UNC5174 […]
The post VMware Tools and Aria 0-Day Under Active Exploitation for Privilege Escalation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly discovered attack on the npm ecosystem has exposed a deceptive backdoor embedded in a malicious package impersonating Postmark. The package, named postmark-mcp, quietly siphoned off thousands of emails from unsuspecting developers and organizations, all with just one line of code. Over the course of 15 incremental releases, the threat actor behind postmark-mcp built […]
The post Malicious Code in Fake Postmark MCP Server Steals Thousands of Emails appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Apple has released a security update for macOS Sequoia 15.7.1 to address a serious vulnerability in its font parser. The flaw, tracked as CVE-2025-43400, allows a maliciously crafted font file to trigger an out-of-bounds write. Exploitation could cause unexpected application crashes or corrupt process memory on affected systems. Apple patched this issue on September 29, 2025, as […]
The post Apple Font Parser Vulnerability Allowing Memory Corruption Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A zero-day local privilege escalation vulnerability in VMware Tools and VMware Aria Operations is being actively exploited in the wild. The flaw, tracked as CVE-2025-41244, allows an unprivileged local attacker to gain root-level code execution on affected systems.
On September 29, 2025, Broadcom disclosed the vulnerability, which exists within VMware’s guest service discovery features. However, security firm NVISO reported identifying zero-day exploitation of this flaw dating back to mid-October 2024 during incident response engagements.
The vulnerability impacts both VMware Tools and VMware Aria Operations, key components used for managing virtualized environments. Successful exploitation allows a user with low privileges to execute arbitrary code within a privileged context, such as the root user on Linux systems.
The flaw affects two distinct service discovery modes:
- Credential-less service discovery: In this mode, the vulnerability lies within the VMware Tools component itself, which is widely deployed on guest virtual machines.
- Legacy credential-based service discovery: Here, the flaw is located within VMware Aria Operations, the management platform for hybrid-cloud workloads.
NVISO researchers confirmed the flaw exists in the open-source variant of VMware Tools,
open-vm-tools, which is distributed with most major Linux distributions.0-Day Vulnerability Exploitation
The root cause of CVE-2025-41244 is an Untrusted Search Path weakness (CWE-426) in the
get-versions.shscript, which is responsible for identifying the versions of services running on a virtual machine.The script uses overly broad regular expressions to locate service binaries. For example, a pattern like
/\S+/httpdis designed to find the Apache web server binary, but will also match a file namedhttpdlocated in a user-writable directory like/tmp.An attacker can exploit this by placing a malicious executable at a path like
/tmp/httpd. They then run this malicious process and have it open a listening socket. When the VMware service discovery process runs (typically every five minutes), it scans for running services.
The flawed script will find and execute the attacker’s malicious binary with the
-vflag to get its version, but it does so with the elevated privileges of the VMware Tools service. This provides the attacker with a root shell, granting them full control over the system.NVISO has attributed the in-the-wild exploitation to UNC5174, a threat actor believed to be sponsored by the Chinese state. This group has a history of leveraging public exploits for initial access operations.
However, researchers noted that due to the trivial nature of the exploit and the common threat actor practice of naming malware after system binaries (e.g.,
httpd), it is unclear if UNC5174 exploited the flaw intentionally or accidentally. It is possible that other malware has been unintentionally benefiting from this privilege escalation for years.Organizations can detect exploitation by monitoring for unusual child processes spawned by
vmtoolsdor theget-versions.shscript. In credential-based mode, forensic evidence may be found in lingering script files located in/tmp/VMware-SDMP-Scripts-{UUID}/directories.Broadcom has released patches and published a security advisory to address CVE-2025-41244, and users are urged to apply the updates immediately.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post VMware Tools and Aria 0-Day Vulnerability Exploited for Privilege Escalation and Code Execution appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A new dark web marketplace listing has sparked alarm in the cybersecurity community after a seller using the handle “SebastianPereiro” purportedly advertised a remote code execution (RCE) exploit targeting Veeam Backup & Replication platforms. The alleged exploit, marketed as the “Bug of June 2025,” is claimed to affect certain versions of Veeam 12.x series, specifically […]
The post Veeam RCE Exploit Allegedly Listed for Sale on Dark Web appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
VMware has released an advisory to address three high-severity vulnerabilities in VMware Aria Operations, VMware Tools, VMware Cloud Foundation, VMware Telco Cloud Platform, and VMware Telco Cloud Infrastructure.
Disclosed on 29 September 2025, the advisory covers CVE-2025-41244, CVE-2025-41245, and CVE-2025-41246 with CVSSv3 base scores ranging from 4.9 to 7.8.
Administrators must apply the patched versions immediately to prevent local privilege escalation, information disclosure, and improper authorization exploits.
Local Privilege Escalation Flaw (CVE-2025-41244)
CVE-2025-41244 is a local privilege escalation vulnerability impacting VMware Aria Operations (all 8.x versions), VMware Tools (12.x, 13.x), and VMware Cloud Foundation Operations.
A malicious local actor with non-administrative privileges on a VM with VMware Tools installed and managed by Aria Operations (SDMP enabled) can exploit this flaw to escalate privileges to root.
Broadcom assigned a CVSSv3 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Resolution requires upgrading to:
Fixed versions include Aria Operations 8.18.5, VMware Tools 13.0.5.0 and 12.5.4, and Cloud Foundation Operations 9.0.1.0. No workarounds are available.
Information Disclosure and Improper Authorization Flaws
CVE-2025-41245 introduces an information disclosure vulnerability in VMware Aria Operations.
An attacker with non-administrative Aria Operations access can disclose other users’ credentials. This flaw carries a CVSSv3 score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
Administrators should upgrade Aria Operations to 8.18.5 or apply the KB92148 patch for earlier Cloud Foundation versions. CVE-2025-41246 is an improper authorization vulnerability in VMware Tools for Windows (all 12.x and 13.x releases).
A malicious user already authenticated via vCenter or ESX could pivot to other guest VMs if they know the target VM credentials. Its CVSSv3 score is 7.6 (AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
Remediation requires updating VMware Tools for Windows to 13.0.5 or 12.5.4.
CVE ID Title CVSSv3.1 Score Severity CVE-2025-41244 Local privilege escalation 7.8 Important CVE-2025-41245 Information disclosure 4.9 Important CVE-2025-41246 Improper authorization 7.6 Important Broadcom credits Maxime Thiebaut (NVISO), Sven Nobis and Lorin Lehawany (ERNW), and Tom Jøran Sønstebyseter Rønning (@L1v1ng0ffTh3L4N) for reporting these issues.
No workarounds exist for any of these vulnerabilities. All affected environments should implement the patches immediately issued by Broadcom.
Administrators without patching capability can temporarily restrict local VM user privileges and limit access to Aria Operations consoles.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post VMware Tools and Aria Operations Vulnerabilities Let Attackers Escalate Privileges to Root appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Western Digital has released security updates for a critical vulnerability affecting multiple My Cloud network-attached storage (NAS) devices.
The flaw, tracked as CVE-2025-30247, could allow a remote attacker to execute arbitrary code on vulnerable systems, potentially leading to a complete device takeover.
The company addressed the high-severity issue in My Cloud Firmware version 5.31.108, which was released on September 24, 2025.
A successful exploit of this remote code execution (RCE) vulnerability would enable an unauthenticated attacker to compromise the security of the NAS device.
This could result in data theft, the deployment of malware or ransomware, or the integration of the compromised device into a botnet for use in further attacks.
Given that NAS devices often store sensitive personal and business data, the impact of such a compromise could be severe.
Western Digital has strongly urged all users to promptly update their devices to the latest firmware to mitigate the threat. The update can be applied directly through the firmware update notification within the device’s administrative interface.
The advisory credits security researcher w1th0ut for discovering and responsibly reporting the vulnerability, allowing the company to develop and issue a patch.
Affected Devices and Mitigation
The security update is crucial for a wide range of products in the My Cloud family. Western Digital has confirmed that the following devices are impacted and should be updated to firmware version 5.31.108 or later to be protected against CVE-2025-30247.
- My Cloud PR2100
- My Cloud PR4100
- My Cloud EX4100
- My Cloud EX2 Ultra
- My Cloud Mirror Gen 2
- My Cloud DL2100
- My Cloud EX2100
- My Cloud DL4100
- My Cloud WDBCTLxxxxxx-10
- My Cloud
This incident highlights the ongoing security risks associated with internet-connected storage devices. Threat actors frequently scan for and target unpatched NAS systems due to the valuable data they contain.
Applying security patches as soon as they become available is one of the most effective measures users can take to protect their data from unauthorized access and cyberattacks.
Users are advised to review their device settings and ensure that automatic updates are enabled, where possible, to maintain security.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post Critical Western Digital My Cloud NAS Devices Vulnerability Let Attackers Execute Malicious Code appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
