• Veeam has released an urgent security patch to address multiple critical remote code execution (RCE) vulnerabilities in Veeam Backup & Replication version 12. These flaws could allow authenticated domain users to run malicious code on backup servers and infrastructure hosts. With attackers likely to reverse-engineer the patch, organizations must apply the update without delay to […]

    The post Critical Veeam Backup RCE Flaws Allow Remote Execution of Malicious Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity threats are rapidly evolving; even advanced operating systems like Windows 11 and Windows Server 2025 can have vulnerabilities due to legacy configurations.

    Horizon Secure highlighted a concerning feature: WDigest authentication, which can be enabled to cache plaintext passwords in memory, potentially exposing users to credential theft.

    Disabled by default since Windows 10 version 1703, WDigest was designed to store hashed credentials for compatibility with older applications.

    However, a simple registry modification can reactivate it, allowing Windows to retain unencrypted passwords during logon sessions.

    The registry key in question HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential set to 1 takes effect immediately upon the next user logon, without requiring a system reboot.

    This means sensitive credentials linger in process memory, ripe for extraction by malware or attackers with local access.

    Attackers covet plaintext credentials because they bypass the need for cracking hashes, enabling quicker lateral movement across networks.

    Tools like Mimikatz have long exploited WDigest for this purpose, and despite Microsoft’s hardening efforts, such as protecting the Local Security Authority Subsystem Service (LSASS) process in Windows 11, vulnerabilities persist.

    LSASS safeguards prevent easy dumping of credentials, but re-enabling WDigest undermines these protections by storing passwords openly.

    Many organizations overlook this risk, especially those running Windows 11 Pro editions. Advanced features like Credential Guard, which virtualizes LSASS for isolation, are exclusive to Enterprise and Education versions.

    Without it, Pro users remain vulnerable if legacy apps demand WDigest compatibility, a common scenario in mixed environments.

    Mitigations

    Fortunately, free built-in tools can counter this threat. The Protected Users group in Active Directory blocks WDigest caching and other weak authentication methods for high-privilege accounts.

    Yet, adoption remains low; security audits often reveal privileged users outside this group, leaving doors ajar.

    Experts urge immediate checks: Scan for the WDigest registry key and audit group memberships. For broader defense, enable multi-factor authentication and monitor for anomalous memory access.

    While Microsoft continues to phase out legacy auth, user vigilance is key to avoiding plaintext pitfalls. As cyber threats target Windows ecosystems, this reminder underscores that security defaults are strong, but misconfigurations can unravel them swiftly.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Windows 11 And Server 2025 Will Start Caching Plaintext Credentials By Enabling WDigest Authentication appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google has released a critical security update for Chrome browser users after discovering a dangerous use-after-free vulnerability that could allow cybercriminals to execute malicious code on victims’ computers. The flaw, tracked as CVE-2025-11756, affects Chrome’s Safe Browsing feature and has earned a High severity rating from Google’s security team. Critical Vulnerability in Chrome’s Safe Browsing […]

    The post Chrome Use-After-Free Flaw Lets Attackers Execute Arbitrary Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Fortinet has disclosed a critical security vulnerability affecting FortiPAM and FortiSwitchManager products that could enable attackers to bypass authentication mechanisms through brute-force attacks. The vulnerability, tracked as CVE-2025-49201, was internally discovered by Gwendal Guégniaud of the Fortinet Product Security team and published on October 14, 2025. Weak Authentication Vulnerability Enables Brute-Force Attacks The security flaw […]

    The post FortiPAM & FortiSwitch Manager Flaw Allows Attackers to Bypass Authentication appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft has disclosed two critical zero-day vulnerabilities in the Agere Modem driver bundled with Windows operating systems, confirming active exploitation to escalate privileges.

    The flaws, tracked as CVE-2025-24990 and CVE-2025-24052, affect the ltmdm64.sys driver and could allow low-privileged attackers to gain full administrator access.

    These issues were patched in the October 2025 cumulative update, but Microsoft warns that affected fax modem hardware will cease functioning post-update.

    Vulnerabilities Exposed In Legacy Driver

    The Agere Modem driver, a third-party component shipped natively in Windows, has long been a dormant risk.

    CVE-2025-24990 stems from an untrusted pointer dereference (CWE-822), enabling attackers to manipulate memory and bypass security boundaries.

    With a CVSS 3.1 score of 7.8, it requires only local access and low privileges, yet yields high impacts on confidentiality, integrity, and availability.

    Microsoft’s threat intelligence team, MSTIC, along with researchers from r-tec IT Security and an anonymous contributor, identified exploitation in the wild.

    The second flaw, CVE-2025-24052, involves a stack-based buffer overflow (CWE-121), scoring 7.8 on CVSS. Publicly disclosed with proof-of-concept code available, it poses a similar threat but has not yet been observed in active attacks.

    Both vulnerabilities persist even without active modem use, affecting all supported Windows versions from Windows 10 onward. Attackers need not interact with hardware; a simple local exploit suffices to elevate rights.

    CVE IDDescriptionCVSS ScoreExploit StatusWeakness
    CVE-2025-24990Untrusted Pointer Dereference in ltmdm64.sys7.8 (Important)Actively Exploited (Functional PoC)CWE-822
    CVE-2025-24052Stack-based Buffer Overflow in ltmdm64.sys7.8 (Important)Proof-of-Concept AvailableCWE-121

    No indicators of compromise (IoCs) were detailed in disclosures, but Microsoft urges scanning for ltmdm64.sys presence.

    These zero-days highlight the dangers of legacy drivers in modern ecosystems. An attacker with an initial foothold, perhaps via phishing or malware, could load the vulnerable driver and execute code to impersonate admins.

    In enterprise settings, this escalates to domain control, data exfiltration, or ransomware deployment. Fabian Mosch from r-tec noted that exploits target driver loading during system boot or service calls, evading user-mode defenses.

    The proof-of-concept for CVE-2025-24990 involves crafting malformed input to the driver’s IOCTL handler, which triggers the dereference of a controlled pointer.

    For CVE-2025-24052, overflow exploits stack corruption via oversized buffers in modem emulation routines. Researchers demonstrated privilege jumps from standard user to SYSTEM level without crashes.

    Microsoft’s Response And User Guidance

    In the October Patch Tuesday release, Microsoft removed ltmdm64.sys entirely, rendering dependent Agere modems obsolete. Users reliant on fax hardware must seek alternatives, as no backward compatibility exists.

    The company advises immediate patching and auditing for the driver via tools like Autoruns. For unpatched systems, disable the driver through Device Manager or group policy.

    This incident underscores the need to phase out outdated components. Cybersecurity experts recommend endpoint detection rules for anomalous driver loads and regular vulnerability scans.

    As exploitation continues, organizations should prioritize these fixes to thwart privilege escalation chains.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Windows Agere Modem Driver 0-Day Vulnerabilities Actively Exploited To Escalate Privileges appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft on Tuesday released fixes for a whopping 183 security flaws spanning its products, including three vulnerabilities that have come under active exploitation in the wild, as the tech giant officially ended support for its Windows 10 operating system unless the PCs are enrolled in the Extended Security Updates (ESU) program. Of the 183 vulnerabilities, eight of them are non-Microsoft

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Sophisticated Threat Actor Compromises 17,000+ Developers Through Trojan Extensions That Steal Code and Mine Cryptocurrency. Operating since early 2025 under multiple publisher accounts (ab-498, 498, and 498-00), this sophisticated campaign deploys extensions that steal source code, mine cryptocurrency, and establish remote backdoors for complete system control. A newly identified threat actor known as TigerJack has […]

    The post TigerJack Hackers Target Developer Marketplaces with 11 Malicious VS Code Extensions appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Fortinet has disclosed a security vulnerability affecting its FortiOS operating system that could allow attackers with administrative privileges to execute unauthorized system commands by bypassing command line interface restrictions. The flaw, tracked as CVE-2025-58325, was discovered internally by Fortinet’s PSIRT team and published on October 14, 2025. Vulnerability Details The security weakness stems from an […]

    The post FortiOS CLI Bypass Flaw Lets Attackers Run Arbitrary System Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The United Kingdom faces an unprecedented cyber security crisis as the National Cyber Security Centre (NCSC) reports handling an average of four ‘nationally significant’ cyber attacks weekly.

    This alarming escalation represents a dangerous shift in the threat landscape, with the NCSC managing 204 nationally significant incidents in the twelve months ending August 2025, more than doubling from 89 attacks recorded in the previous year.

    The threat environment has reached critical proportions, with 18 incidents classified as ‘highly significant’ during the reporting period.

    These attacks carried the potential for severe disruption to essential services and infrastructure, marking an almost 50% increase from the previous year and continuing a three-year upward trend.

    The NCSC’s latest Annual Review reveals that over half of all 429 incidents handled required national-level coordination, underscoring the systematic nature of these threats against UK interests.

    A substantial proportion of these attacks originated from Advanced Persistent Threat (APT) actors, including both nation-state operatives and sophisticated criminal organizations.

    National Cyber Security Centre (NCSC) analysts noted the increasing complexity and persistence of these threat actors, who demonstrate advanced capabilities in targeting critical infrastructure, government systems, and private sector networks.

    The attacks have demonstrated significant impact potential across the UK’s national security apparatus, economic systems, and essential service providers.

    Dr Richard Horne, NCSC Chief Executive, emphasized that cyber security has evolved into a matter of business survival and national resilience.

    The escalating threat demands immediate action from business leaders, as hesitation represents a fundamental vulnerability that attackers readily exploit.

    Government Response and Industry Collaboration

    The severity of the situation has prompted direct government intervention, with official correspondence sent to chief executives and chairs of major UK businesses, including all FTSE350 companies.

    This coordinated approach aims to establish cyber resilience as a board-level responsibility while fostering collaboration between government and private sector entities.

    The NCSC has simultaneously launched the Cyber Action Toolkit, specifically designed to assist small organizations in implementing foundational security controls against common threats.

    The initiative includes promotion of the Cyber Essentials certification scheme, which provides automatic cyber liability insurance for qualifying UK organizations with annual turnover below £20 million, creating financial incentives for proper security implementation across the business landscape.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post NCSC Warns of UK Experiencing Four Cyber Attacks Every Week appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The defense industry must produce counterdrone technology quickly—and in high numbers—to stay ahead of a potential drone threat. But delicate supply chains can make it harder for some companies to meet demand—even if their tech meets the Army’s needs. 

    “I have a lot of niche capabilities that are out there, but we may be challenged in scaling from an industrial perspective,” Col. Marc Pelini, who leads the Army’s air and missile defense cross-functional team, said during a counterdrone panel at the Association of the U.S. Army’s annual conference Monday.

    “If you look at some of the open source reporting on what's been going on in Ukraine and Russia the last few months—I think this figure I saw, in August, the Russians used up to 30,000 first person view drones. So, the scale is absolutely one of the most critical elements, which gets to some of the other comments about being able to try multiple different approaches to be able to attack it from different vectors,” said Brig. Gen. Glenn Henke, commandant for U.S. Army Air Defense Artillery and deputy commanding officer for Fort Sill’s Fires Center of Excellence.

    Eprius, which makes a series of high-powered microwave non-kinetic weapons, is acutely aware of how hard high-output production is, especially with supply chain constraints around high-powered amplifiers. But Andy Lowery, Epirus’ CEO, wants to be ready once the Army and other government customers decide on a program of record for counterdrone tech. 

    “Primarily this year has been about a year preparing to scale,” he said. “That is a major problem for us.”

    The company, which has a manufacturing plant in Torrance, Calif., wants to expand capacity with a new facility that Lowery hopes to announce a final location for in the summer of 2026. But in the nearterm, Epirus is leaning on its partnership with General Dynamics to double production ability. 

    “We've got seven systems in progress right now. But if 70 were to be the ask? One of our systems has 148,000 parts in it—15,000 are build-to-print, 135,000 are commercial-off-the-shelf. It is not easy to swing from seven to 70,” Lowery previously told Defense One.

    The details aren’t completely ironed out, but the goal is to have General Dynamics, which Epirus teamed up with for a manned and unmanned version of its high-powered microwave, do a lot of the metal work. 

    “As a manufacturing prime, we have substantial capacity to produce and ramp up at scale manufacturing of new equipment. Early on, our partnership with Epirus was far more just in the lines of ‘Hey, they had a powerful capability that they thought would integrate onto our Stryker,’” 

    G. Scott Taylor, who leads business development for General Dynamics Land Systems, told Defense One. “We would build a lot of the framework around it, and they would continue and focus on building the [line replaceable amplifier modules] themselves.” 

    If successful, Lowery hopes to replicate the model regionally, letting prime defense contractors do the “heavy lifting” more locally. 

    Established defense contractors partnering with newer companies isn’t new, but could become increasingly necessary as the Pentagon encourages more contracts with non-traditional companies that may not have the experience or capacity to make high quantities of what the military needs.  

    “If you didn't already have the factory, a lot of these guys are saying, ‘Why do I want to build my own factory…So we step in at times,” even for larger companies like Boeing or Viasat, when “there's synergy with our product line or with our customer base,” said Mike Sheehan, president and CEO for Thales Defense & Security, Inc.  and security. 

    Besides doing metalwork, bigger contractors can shoulder some of the certification requirements, like auditable accounting systems. 

    “One sort of ironic thing about your traditional defense companies, and then your non-traditional defense companies: traditional defense contractors need to be certified. [Your] cost accounting system needs to be certified; you get audited regularly. DCMA, DCAA, they monitor your rates. They limit how much profit you can make on fixed-price jobs and all that. And it's a tremendous amount of work and overhead on both the government side and industry side to keep that going.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶