• Global advertising and marketing giant Dentsu has confirmed that its U.S.-based subsidiary Merkle experienced a cyberattack, prompting immediate incident response measures and system shutdowns to contain the breach.

    The company detected abnormal activity within Merkle’s network infrastructure, which led to proactive security protocols being deployed to minimize operational impact.

    Merkle, recognized as a leader in Customer Experience Management for Dentsu’s international operations, was targeted in the cyber incident that affected portions of its network systems.

    Upon discovering the suspicious activity, Dentsu’s security teams immediately activated incident response procedures and made the strategic decision to shut down certain systems as a precautionary measure.

    Investigation and Regulatory Compliance

    The incident underscores the growing threat landscape facing major marketing and customer data management firms that handle sensitive client information across multiple industries.

    Merkle serves numerous Fortune 500 companies and manages vast amounts of customer data, making it an attractive target for cybercriminals seeking valuable corporate and consumer information.

    Dentsu has engaged an external cybersecurity firm with extensive experience handling similar breach investigations to assist with forensic analysis and remediation efforts.

    The company emphasized its commitment to transparency by reporting the incident to relevant authorities in compliance with data protection regulations across different jurisdictions where it operates.

    The ongoing investigation aims to determine the full extent of the breach, including what data may have been accessed or compromised, the attack vector used by threat actors, and whether any client information was exposed.

    As organizations increasingly face sophisticated cyber threats, rapid detection and response have become critical components of enterprise security strategies. Dentsu has clarified that the cyberattack was isolated to Merkle’s U.S. operations and did not impact the company’s network systems in Japan.

    This geographic containment suggests that Dentsu maintains segmented network infrastructure across its global operations, which helped prevent the incident from spreading to other regional divisions. However, the company acknowledged that financial repercussions are anticipated as a result of the breach.

    Dentsu stated it is continuing to assess both the magnitude and timeline of the expected financial impact, which could include incident response costs, potential regulatory fines, customer notification expenses, and possible remediation investments to strengthen security controls.

    The disclosure comes amid heightened scrutiny of cybersecurity practices across the marketing technology sector, where companies process massive volumes of consumer data for targeted advertising and personalized customer experiences.

    As investigations continue, Dentsu remains focused on restoring full operational capabilities while implementing enhanced security measures to prevent future incidents.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Dentsu has Disclosed that its U.S.-based Subsidiary Merkle Suffers Cyberattack appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated malware campaign is actively targeting WordPress e-commerce websites using the WooCommerce plugin, according to recent findings from the Wordfence Threat Intelligence Team. The malware campaign, which employs advanced evasion techniques and multi-layered attack strategies, disguises itself as a legitimate WordPress plugin while secretly stealing credit card information from unsuspecting online shoppers. The malicious […]

    The post New Malware Infects WooCommerce Sites Through Fake Plugins to Steal Credit Card Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google has released Chrome version 142 to the stable channel, addressing multiple critical security vulnerabilities that could allow attackers to execute malicious code on affected systems. The update, now rolling out to Windows, Mac, and Linux users, contains fixes for 20 security flaws discovered by external researchers and Google’s internal security teams. Overview of the […]

    The post Chrome 142 Update Patches 20 Security Flaws Enabling Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft has patched a critical race condition vulnerability in its Windows Cloud Files Minifilter driver, known as CVE-2025-55680, which enables local attackers to escalate privileges and create arbitrary files across the system.

    Discovered by researchers at Exodus Intelligence in March 2024, the flaw was addressed in the October 2025 Patch Tuesday updates, earning a CVSS score of 7.8 for its potential to grant SYSTEM-level access through DLL side-loading.

    While no widespread in-the-wild exploitation has been confirmed, security experts classify it as “exploitation more likely” due to the straightforward nature of the time-of-check to time-of-use (TOCTOU) weakness in the cldflt.sys driver.

    Understanding The Cloud Files Minifilter

    The Cloud Files Minifilter driver powers features like OneDrive’s Files On-Demand, allowing seamless synchronization of cloud-stored files as local placeholders that hydrate on access.

    Registered via the CfRegisterSyncRoot API in cldapi.dll, sync root directories enforce policies for hydration when files download and population, controlling how directories reveal cloud contents.

    These placeholders, managed through IOCTL code 0x903BC, represent files in states like pinned, full, or partial, relying on the minifilter to handle operations such as creation via CfCreatePlaceholders.

    The driver intercepts IRP major functions for file creation, reading, writing, and controlling, processing user requests in kernel mode to ensure secure cloud integration, Exodus Intelligence said.

    However, this tight coupling between user-space APIs and kernel handling introduces risks when validating inputs like filenames during placeholder creation.

    Race Condition Flaw Leads to Privilege Escalation

    At the core of CVE-2025-55680 lies the HsmpOpCreatePlaceholders function in cldflt.sys, triggered by CfCreatePlaceholders to build placeholders under a sync root.

    The function first probes and maps the user-supplied buffer containing the relative filename (relName) into kernel space using IoAllocateMdl and MmMapLockedPagesSpecifyCache, sharing physical memory between user and kernel views.

    Exploit Chain
    Exploit Chain

    It then validates relName against forbidden characters such as backslash ($$ or colon (:)), a safeguard added post-CVE-2020-17136.

    Yet, a narrow window exists between this check and the subsequent FltCreateFileEx2 call to create the file.

    Attackers can exploit this TOCTOU by altering the mapped buffer, replacing a character like ‘D’ with ” in a string such as “JUSTASTRINGDnewfile.dll” to form “JUSTASTRING\newfile.dll”, causing the driver to follow a pre-set junction point to privileged paths like C:\Windows\System32.

    Without flags to block symlinks, the file lands in restricted areas, bypassing permissions.

    Exploitation demands low privileges but coordinates multiple threads: one monitors for file creation in System32, others spam CfCreatePlaceholders with benign payloads, and racers toggle the buffer byte to win the timing race.

    Success allows dropping a malicious DLL, hijacked by services like those in System32, for side-loading, yielding kernel-context code execution. Setup involves registering a sync root and junction, with cleanup post-escalation.

    Microsoft urges immediate patching, emphasizing endpoint detection for anomalous file ops in cloud sync dirs.

    Enterprises should audit OneDrive usage and enforce least-privilege policies to mitigate local threats. As cloud reliance grows, such kernel flaws underscore the perils of bridging user and system spaces.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft Windows Cloud Files Minifilter Privilege Escalation Vulnerability Exploited appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The VSCode extension marketplace has become a critical vulnerability in the software supply chain. Security researchers at HelixGuard Team recently discovered 12 malicious extensions operating within the Microsoft VSCode Marketplace and OpenVSX, with four remaining active despite their detection. These extensions employ sophisticated techniques to steal source code, exfiltrate sensitive credentials, establish remote backdoors, and […]

    The post 12 Malicious Extensions in VSCode Marketplace Steal Source Code and Exfiltrate Login Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google has officially promoted Chrome 142 to the stable channel, delivering critical security updates for Windows, Mac, and Linux users.

    The rollout begins immediately and will continue over the next few days or weeks, ensuring widespread protection against newly discovered threats.

    This version addresses 20 vulnerabilities, many of which could enable attackers to execute malicious code remotely, potentially compromising user data and system integrity.

    The update underscores Google’s commitment to rapid response in the face of evolving browser-based attacks.

    Chrome 142.0.7444.59 for Linux, 142.0.7444.59/60 for Windows, and 142.0.7444.60 for Mac incorporate a range of fixes and performance improvements.

    Detailed change logs are available through Chromium’s source repository, highlighting enhancements in rendering, stability, and user interface.

    While full details on new features will appear in upcoming posts on the Chrome and Chromium blogs, the immediate priority is bolstering defenses against exploitation attempts.

    Security experts recommend users enable automatic updates to mitigate risks promptly, as unpatched browsers remain prime targets for cybercriminals.

    Chrome 142 Released – Fix for 20 Vulnerabilities

    The update addresses a wide range of vulnerabilities, including 20 security patches. Details about the bugs will initially remain confidential to allow for global deployment and to prevent facilitating active exploits.

    Several fixes arise from external researchers, earning bounties under Google’s Vulnerability Reward Program, while others result from internal audits and fuzzing tools like AddressSanitizer and libFuzzer.

    High-severity issues dominate, particularly in the V8 JavaScript engine, where type confusion, race conditions, and inappropriate implementations could lead to arbitrary code execution.

    Media handling and extensions also receive attention, closing gaps that might allow unauthorized access or policy bypasses. Lower-severity fixes address UI inconsistencies and storage races, preventing subtle but persistent risks.

    For a breakdown of key externally reported vulnerabilities, see the table below:

    CVE IDSeverityDescriptionReporterBountyReport Date
    CVE-2025-12428HighType Confusion in V8Man Yue Mo (GitHub Security Lab)$50,0002025-09-26
    CVE-2025-12429HighInappropriate implementation in V8Aorui Zhang$50,0002025-10-10
    CVE-2025-12430HighObject lifecycle issue in Mediaround.about$10,0002025-09-04
    CVE-2025-12431HighInappropriate implementation in ExtensionsAlesandro Ortiz$4,0002025-08-06
    CVE-2025-12432HighRace in V8Google Big SleepN/A2025-08-18
    CVE-2025-12433HighInappropriate implementation in V8Google Big SleepN/A2025-10-07
    CVE-2025-12036HighInappropriate implementation in V8Google Big SleepN/A2025-10-15
    CVE-2025-12434MediumRace in StorageLijo A.T$3,0002024-04-27
    CVE-2025-12435MediumIncorrect security UI in OmniboxHafiizh$3,0002025-09-21
    CVE-2025-12436MediumPolicy bypass in ExtensionsLuan Herrera (@lbherrera_)$2,0002021-02-08

    (Additional medium and low-severity fixes include use-after-free errors in PageInfo and Ozone, out-of-bounds reads in V8 and WebXR, and UI issues in Autofill, Fullscreen, and SplitView, reported by researchers like Umar Farooq, Wei Yuan, and Khalil Zhani.)

    Google extends thanks to contributors who helped squash these bugs before they hit production. Internal efforts, including fuzzing and sanitizer tools, accounted for numerous fixes, preventing a wide array of potential exploits.

    As browser usage surges amid rising phishing and malware campaigns, this release reinforces Chrome’s position as a secure default for billions. Users should verify updates via chrome://settings/help to stay protected.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Chrome 142 Released With Fix for 20 Vulnerabilities that Allows Malicious Code Execution appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The global developer community has been rocked by the emergence of PhantomRaven, a far-reaching campaign involving 126 malicious npm packages with more than 86,000 downloads. Lurking beneath the surface, these packages actively steal npm tokens, GitHub credentials, and CI/CD secrets from unsuspecting developers across the world. Despite their scale and impact, the attackers have leveraged […]

    The post PhantomRaven Attack Discovered in 126 Malicious npm Packages, Exceeding 86,000 Downloads appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about active exploitation of a critical vulnerability affecting Windows Server Update Service (WSUS). The agency updated its alert on October 29, 2025, adding crucial information about identifying vulnerable systems and detecting potential threats. Critical Flaw in Windows Server Update Service Microsoft released an […]

    The post CISA Alerts on Active Exploitation of WSUS Vulnerability appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical security flaw has been discovered in the Anti-Malware Security and Brute-Force Firewall WordPress plugin, putting more than 100,000 websites at risk. The vulnerability, identified as CVE-2025-11705, allows authenticated attackers with basic subscriber-level access to read any file stored on the web server, potentially exposing sensitive data including database credentials and security keys. Attribute […]

    The post WordPress Plugin Vulnerability Lets Attackers Read Any Server File appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers at XLab have uncovered a sophisticated infrastructure-as-a-service botnet operation called PolarEdge, which has compromised over 25,000 Internet of Things devices and established 140 command-and-control servers through systematic exploitation of vulnerable edge devices. The newly exposed RPX relay system reveals how threat actors construct operational relay box networks that effectively conceal attack sources and […]

    The post PolarEdge Botnet Hits 25K IoT Devices in Major Cyber Campaign appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶