• Broadcom released VMSA-2025-0016 to address three key vulnerabilities affecting VMware vCenter Server and NSX products. The vulnerabilities include an SMTP header injection in vCenter (CVE-2025-41250) and two distinct username enumeration flaws in NSX (CVE-2025-41251 and CVE-2025-41252). All three are rated in the Important severity range with CVSSv3 scores between 7.5 and 8.5. CVE ID Description CVSSv3 Affected […]

    The post VMware vCenter and NSX Flaws Allow Hackers to Enumerate Usernames appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Apple has rolled out security updates across its operating systems to address a vulnerability in the Font Parser component that could allow malicious fonts to crash applications or corrupt process memory.

    The vulnerability, identified as CVE-2025-43400, affects a wide range of products, including the newly released macOS Tahoe and iOS 26, as well as older versions.

    The vulnerability is an out-of-bounds write issue in FontParser. This type of memory safety flaw enables a program to write data beyond the end of an allocated buffer, resulting in unpredictable behavior.

    An attacker could exploit this by embedding a specially crafted font in a document, email, or webpage. When a user interacts with this content, the vulnerable Font Parser component may be triggered, potentially leading to app termination or memory corruption.

    Apple has addressed the issue by implementing improved bounds checking, ensuring the software stays within its designated memory space when processing font data.

    According to Apple’s advisory released on September 29, 2025, there are no known instances of this vulnerability being exploited in the wild.

    It remains unclear whether the flaw could be leveraged for arbitrary code execution, which would be a more severe threat. However, the potential for denial-of-service attacks or memory corruption makes it a critical issue that needs to be addressed.

    The security fix affects a wide range of Apple products, underscoring the shared codebase across its ecosystem.

    While Apple also released updates for watchOS and tvOS, they did not include patches for this vulnerability. Users are strongly encouraged to apply the latest updates to all affected devices to mitigate any potential risk.

    Apple Security Patches

    ProductPatched Version
    iOS & iPadOS26.0.1
    iOS & iPadOS18.7.1
    macOS Tahoe26.0.1
    macOS Sequoia15.7.1
    macOS Sonoma14.8.1
    visionOS26.0.1

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Apple Font Parser Vulnerability Enables Malicious Fonts to Crash or Corrupt Process Memory appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical security flaw impacting the Sudo command-line utility for Linux and Unix-like operating systems to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerability in question is CVE-2025-32463 (CVSS score: 9.3), which affects Sudo versions prior to

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Luxury department store Harrods has become the latest victim of a significant cybersecurity incident after hackers successfully accessed personal data belonging to 430,000 customers. The prestigious London retailer confirmed that threat actors contacted the company following the breach, though Harrods has stated it will not engage with the attackers. Limited Data Exposure The compromised information was obtained from […]

    The post New Harrods Data Breach Leaks Personal Information of 430,000 Customers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • VMware has disclosed critical security vulnerabilities in vCenter Server and NSX platforms that could allow attackers to enumerate valid usernames and manipulate system notifications. 

    The vulnerabilities, tracked as CVE-2025-41250, CVE-2025-41251, and CVE-2025-41252, affect multiple VMware products, including Cloud Foundation, vSphere Foundation, NSX, NSX-T, and Telco Cloud platforms.

    Broadcom, which acquired VMware, released a security advisory on September 29, 2025, rating the vulnerabilities with CVSS base scores ranging from 7.5 to 8.5, classifying them as “Important” severity. 

    The National Security Agency (NSA) reported two of the three vulnerabilities, highlighting their potential national security implications.

    vCenter SMTP Header Injection Vulnerability

    The first vulnerability, CVE-2025-41250, is an SMTP header injection flaw in VMware vCenter Server with a CVSS score of 8.5. 

    This vulnerability enables malicious actors with non-administrative privileges who have permission to create scheduled tasks to manipulate notification emails sent for those tasks.

    The attack vector requires authenticated access to vCenter with task creation permissions. By exploiting SMTP header injection techniques, attackers can modify email headers, potentially redirecting notifications, inserting malicious content, or bypassing email security filters. 

    This could lead to social engineering attacks, credential harvesting, or unauthorized disclosure of information through manipulated email communications.

    Affected products include vCenter Server versions 7.0, 8.0, and 9.x across various VMware Cloud Foundation and vSphere Foundation deployments. 

    The vulnerability impacts VMware Telco Cloud Platform versions 2.x through 5.x and Telco Cloud Infrastructure versions 2.x and 3.x.

    Per von Zweigbergk receives acknowledgment for responsibly disclosing this vulnerability to Broadcom. No workarounds are available, requiring organizations to apply the provided security patches immediately.

    NSX Username Enumeration Vulnerabilities

    Two separate username enumeration vulnerabilities affect NSX platforms, creating pathways for reconnaissance attacks. 

    CVE-2025-41251, with a CVSS score of 8.1, represents a weak password recovery mechanism vulnerability allowing unauthenticated attackers to enumerate valid usernames through password recovery processes.

    CVE-2025-41252, scoring 7.5 on the CVSS scale, is a direct username enumeration vulnerability that permits unauthenticated malicious actors to identify valid usernames without requiring authentication. 

    Both vulnerabilities can serve as reconnaissance tools for subsequent brute-force attacks or targeted credential stuffing campaigns.

    Username enumeration attacks typically exploit differences in application responses when processing valid versus invalid usernames. 

    Attackers can analyze response times, error messages, HTTP status codes, or other behavioral patterns to determine which usernames exist in the system. 

    This information becomes valuable for password spraying attacks, social engineering campaigns, or targeted phishing attempts.

    The NSX vulnerabilities affect VMware NSX versions 4.0.x through 4.2.x, NSX-T version 3.x, and NSX components within Cloud Foundation and Telco Cloud platforms. 

    Organizations running these platforms face immediate exposure to reconnaissance attacks that could facilitate broader compromise attempts.

    Security patches are available through various fixed versions, including NSX 4.2.2.2, 4.2.3.1, 4.1.2.7, and NSX-T 3.2.4.3. 

    CVETitleCVSS 3.1 ScoreSeverity
    CVE-2025-41250vCenter SMTP Header Injection Vulnerability8.5Important
    CVE-2025-41251NSX Weak Password Recovery Mechanism Vulnerability8.1Important
    CVE-2025-41252NSX Username Enumeration Vulnerability7.5Important

    VMware Cloud Foundation users should implement asynchronous patching procedures documented in KB88287. Meanwhile, Telco Cloud Platform and Infrastructure users should refer to KB411518 for update guidance.

    The NSA’s involvement in reporting these vulnerabilities underscores their significance for enterprise and government environments where VMware infrastructure provides critical virtualization and networking services. 

    Broadcom has already released patches that organizations should prioritize to address these vulnerabilities, as username enumeration could enable more sophisticated attack campaigns targeting virtualized infrastructure.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post VMware vCenter and NSX Vulnerabilities Let Attackers Enumerate Valid Usernames appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated cybercriminal group known as Lunar Spider successfully compromised a Windows machine through a single malicious click, establishing a foothold that allowed them to harvest credentials and maintain persistent access for nearly two months. The intrusion, which began in May 2024, demonstrates the evolving threat landscape where initial access can rapidly escalate to full […]

    The post Lunar Spider Infected Windows Machine in Single Click and Harvested Login Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have identified a sophisticated campaign where threat actors are using malicious advertisements and search engine optimization poisoning to distribute fake Microsoft Teams installers containing the Oyster backdoor malware. The campaign targets users searching for legitimate Microsoft Teams downloads through search engines. When users search for terms like “teams download,” they encounter fraudulent sponsored […]

    The post Hackers Distribute Malicious Microsoft Teams Build to Steal Remote Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Those who study civilian-military relations talk frequently about the unequal dialogue between America’s civilian and uniformed leaders. Civilian leaders sit atop the chain of command and have the final word on defense policy and strategy matters. In return, they have the responsibility to respect—in the sense of listen closely to, not defer to—the military advice of those in uniform. Without this respect, the dialogue ceases to be a conversation and becomes a series of partisan orders.

    Defense Secretary Pete Hegseth’s short-notice, no-explanation summoning of more than 800 general and flag officers from command positions around the world demonstrates a lack of respect for their time and their jobs. It suggests a concomitant lack of respect for their advice. 

    Perhaps this was unintentional, in which case Secretary Hegseth could apologize and cancel the meeting. Short of that, he could take the opportunity at Quantico to acknowledge and underscore the respect due to general and flag officers. 

    First, he should vow to respect the non-partisan nature of military service. General and flag officers have taken an oath to the support and defend the U.S. Constitution from their earliest days in uniform, and reaffirmed that oath with each subsequent promotion. Hegseth should cease and disavow any initiative to separate these officers from their oath, especially by inserting hints of partisanship into key actions such as promotions or intelligence reporting, 

    Second, the secretary should acknowledge the professionalism of general and flag officers, who have spent years acquiring expertise and assuming increased responsibility for recruiting, organizing, training, equipping, and employing the American military, in peace and war. They know their subordinates need to be ready to fight today and tomorrow, and do not need to be reminded of this fundamental responsibility. 

    Third, as a corollary, if senior civilians feel obligated to fire general and flag officers, they need to state the reason for the firing. The secretary has removed nearly a dozen general and flag officers over the past nine months without explanation. Many of those fired have been women or people of color. Absent an explanation, it seems these flag offers were fired for who they are rather than how they did their job. Such targeted actions will undermine trust between senior civilians and flag officers, and send a chilling message to these groups about whether or not leadership sees any value in their service.

    Finally, senior civilian leaders should show respect for general and flag officers as people. They are busy people doing critical work; their time should be appropriately respected and their efforts disrupted only when necessary. This is, or should be, basic to a leader of a large organization. 

    But what if the short-notice summons was intentionally disrespectful, an odd attempt to display dominance? This would indicate that the unequal dialogue has already begun to shift toward the partisan—and a fundamental change in civilian-military relations in the United States.

    How might such a shift manifest itself? You might see senior officers putting in for early retirement, thus removing themselves from any dialogue; choosing to keep quiet amid confused and confusing actions by civilian leaders; preemptively complying with implied, but not issued, orders; aggressively implementing the secretary’s agenda to demonstrate fealty to him; and publicly embracing partisanship for reasons ranging from strong personal support for the administration to hopes for further advancement. 

    Should such actions continue, they might add up to profound culture change in the general and flag officer corps—one shaped by partisanship rather than the Constitution. That would be catastrophic for the civilian-military dialogue, the military itself, and the country.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A shutdown would sideline federal cyber defenders just as a bedrock cybersecurity data-sharing law expires, leaving the government unusually vulnerable, cybersecurity experts warn.

    “The absence of security personnel working to protect the nation from these threats can create a security gap and an opportunity for malicious actors to exploit weaknesses,” said Ilona Cohen, chief legal and policy officer at HackerOne and former general counsel at the Office of Management and Budget.

    Cohen said infrastructure owners and operators would be less able to reach officials and data, and the government's cyber workforce would suffer if no funding bill is passed by Oct. 1.

    Only an estimated 889 of 2,540 employees would continue to work at the Cybersecurity and Infrastructure Security Agency, the nation’s main cyber defense office tasked with defending government networks, according to a planning document posted Saturday.

    Among them would be people confronting an emerging cyber threat group, believed linked to China, exploiting vulnerabilities in Cisco devices, Chris Butera, CISA’s acting deputy executive assistant director for cybersecurity, told reporters last week.

    There are risky domino effects of having a diminished federal cyber workforce, said one former U.S. official who requested anonymity because they weren’t authorized to publicly speak about the impact of a shutdown. Specifically, younger cyber staffers can’t learn from their more experienced peers because they will not be able to come into work.

    “They’re losing time to upskill, to get trained and to get on-the-job training because they’re not there. It hurts not only the current workforce but the future workforce as well,” the former official said.

    Gary Barlet, the public-sector chief technology officer at Illumio, echoed those concerns. 

    “This year, the challenge is sharper because agencies are already stretched thin,” Barlet told Nextgov/FCW in a written statement. “Many of the employees who guided past shutdowns aren’t there anymore, leaving fewer people who know how to manage through the disruption — exposing critical gaps and reducing the ability to respond quickly.”

    The 2015 Cybersecurity Information Sharing Act, which lets private-sector providers transmit cyber threat intelligence with government partners while receiving key legal protections, is also set to lapse on Tuesday evening unless renewed by Congress. 

    House appropriators earlier this month unveiled a temporary funding plan that would keep the law alive through Nov. 21 and fund the government until the same date. That would have given Congress simultaneous time to work out funding snags and reconcile any debate about changes needed for the cyber law that was first enacted 10 years ago. But that continuing resolution failed to pass in the Senate.

    The agreement etched between the public and private sectors for information-sharing is “really important,” Tim Brennan, the VP for technology policy and government relations at the Professional Services Council, told reporters Monday.

    “You’re going to get less information-sharing, which means delayed response times,” he said, adding that it would impact mission functions inside agencies like the Department of Homeland Security, which houses CISA.

    The liability coverage provided by the data-sharing law is critically important to the private sector because it makes companies more comfortable with transmitting cyber threat data, Morgan Adamski, the former executive director of U.S. Cyber Command, told Nextgov/FCW in an interview.

    “When you have a tool like CISA 2015 that’s valuable in contributing to information-sharing between the public sector and the private sector, why wouldn’t you want to have it in place to really encourage that collaboration?” added Adamski, now U.S. leader in PwC’s Cyber, Data & Technology Risk business.

    “Something has to be put in place to enable that collaboration, or you’re potentially going to see an impact on information sharing, which collectively hurts us from better understanding what’s happening in the cyberspace domain,” she said.

    On Monday, congressional Democrats said they were unable to reach an agreement with Republican counterparts and the White House, upping the odds of a shutdown occurring.

    Last week, OMB told agencies to consider issuing reduction notices to employees whose work is funded by regular appropriations and doesn’t align with President Donald Trump’s priorities if annual spending lapses Tuesday evening. The Office of Personnel Management issued new guidance Sunday, telling agencies that it can tweak those plans once the government reopens.

    Nextgov/FCW Staff Reporter Natalie Alms contributed to this report.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • As the Trump administration pushes to “aggressively adopt AI” in the military, there’s a recognition that some of the models may have protections or limitations that aren’t applicable in a military context. To be sure, some of these will need modification to suit the military’s mission. But there are many reasons that the military will want to have guardrails built in, for its own protection.

    Policymakers and AI labs should collaborate on how to adapt guardrails specifically for military uses. Some existing guardrails, like discouraging users from killing people, are inapplicable to military use where mission lethality is essential. But removing all guardrails without contextually appropriate replacements could have severe consequences. This is why the Trump administration's decision to move responsibility for AI under the R&D umbrella makes sense. It will allow for “going fast” to work out the kinks, while not “breaking things” in ongoing military operations.

    Some of the protections that need developing could focus on preventing external malicious actors from misusing AI, while others should focus on preventing authorized users from creating harm from within.

    As the former deputy assistant defense secretary for cyber policy, I've seen how aggressively external malicious cyber actors are trying to get into DOD and other systems. PRC cyber campaigns such as Volt Typhoon have found success in so-called “living off the land” techniques, wielding the stolen credentials of legitimate users for nefarious purposes. Using those techniques, malign actors could target AI systems already deployed inside the Department, but also the companies that are training and tailoring those systems, with the aim of altering their output. 

    It’s not just the malicious hackers who pose a danger in using these AI systems. In an organization as large as the military, the risk from human flaws, enabled by AI systems, become even greater. 

    Insider threats are nothing new to the military. But with growing concern over chatbots’ abilities to manipulate their users and—even unintentionally—lead them down “AI psychosis“ mental-health crises, these threats could grow in number or severity. 

    Imagine a disgruntled service member asking AI to develop plan to evade security protocols and sell classified data or leaders’ emails. While it took Edward Snowden years to develop deep knowledge of NSA systems, AI tools trained on network architectures and military systems could help even novices identify loopholes. Or imagine someone requesting help with ransomware campaigns—something Anthropic recently detected Claude was manipulated into doing—but operating from military infrastructure. Appropriate guardrails could help trip alarms when someone is doing something the military would want to prevent or prosecute.

    But what if the signs of AI misuse are immune from network forensics—and live entirely inside a user’s head? Imagine a service member who stands watch over the nation’s nuclear weapons, and who—via interactions with both personal and professional LLM tools—has stumbled into believing the world may in fact be a digital simulation. 

    Detecting mental-health risks from AI use is already a challenge in civilian contexts; guardrails for military contexts will be harder and of often of greater consequence. When should an AI system alert a user’s chain of command of a concerning line of inquiry? 

    There’s a distinction between the technical risk and vulnerability that exists in AI systems and the human behaviors and queries that need guidance and limitation. One could address the technical risks from outsiders by ensuring that AI systems are built and deployed in ways that take cybersecurity into account at the beginning instead of waiting for compromise and then patching. 

    Defining and determining “what right looks like” in responsible military use of AI systems will be a nuanced undertaking. Guardrails must match the wide variation of missions within the military from business systems to command and control. Often, the answers may not even be technical ones, but instead policy or behavioral. 

    To address these challenges, the Department should work with AI companies to develop models that can detect threats in real time—not just malicious queries, but patterns suggesting psychological manipulation or insider risk. We need to start discussing what kinds of queries or activities should be blocked, redirected (like OpenAI's “safe completions“), or requiring immediate command notification. This is why the Trump administration’s decision to move responsibility for AI to the research-and-engineering parts of the military is a prudent one.

    Developing such protections, values, and policies, consistent with the military’s values, should not be seen as hitting the brakes on AI adoption, but to keep it on track for success. The AI era has the opportunity to get off on the right foot, combining speed of deployment with safety and transparency of use.

    Mieke Eoyang is the former Deputy Assistant Secretary of Defense for Cyber Policy, and a former professional staff member on the House Permanent Select Committee on Intelligence. She is a non-resident senior fellow at the Carnegie Mellon Institute for Strategy and Technology. The views expressed are those of the author. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶