• New York, New York, USA, October 27th, 2025, CyberNewsWire

    nsKnox, a leader in payment security, today announced the launch of Adaptive Payment Security, a groundbreaking enhancement to its PaymentKnox platform designed to eliminate B2B payment fraud by providing the fastest possible bank account validation with the flexibility to achieve irrefutable certainty on demand.

    The platform enables organizations to validate any account, anywhere in the world, using authoritative data from the banking system.

    The new capability directly addresses the “Impossible Triangle” of payment fraud prevention, where businesses are typically forced to compromise between speed, certainty, and effort when validating vendor and partner bank accounts.

    Adaptive Payment Security transforms this trade-off by intelligently adapting its validation method to the risk level and business need.

    Adaptive Payment Security seamlessly integrates into existing payment workflows and features two core validation components:

    1.  Quick Check: A smart, rapid, in-network search across the nsKnox database and extensive global partner network, designed to provide high-speed, low-effort validation where strong matches exist.

    2.  Knox Verify: Provides irrefutable, true global validation for any account, even out-of-network. This proprietary method dynamically extracts authoritative data directly from the banking system, eliminating the risks associated with unreliable documents or insecure manual confirmation calls.

    The solution is further enhanced by Community Insights, which leverages the anonymized, collective intelligence of the nsKnox community to provide an added layer of trust and confidence to validation results.

    “For too long, finance departments have been forced to choose between moving quickly and being sure, leaving a massive gap for fraudsters to exploit,” said Nithai Barzam, CEO of nsKnox.

    “Our Adaptive Payment Security changes this dynamic entirely. We provide businesses with the control to achieve maximum speed and efficiency when possible, while maintaining a clear path to certainty—backed by authoritative banking data. This marks a fundamental shift from compromise to complete payment authority.”

    Adaptive Payment Security is built on nsKnox’s patented Cooperative Cyber Security (CCS) technology, which distributes payment information across a decentralized network, making it mathematically impossible for fraudsters to compromise.

    The solution provides standardized, global controls, increased efficiency through automation, and ensures systematic compliance across all vendor data and payments.

    About nsKnox

    nsKnox is the global standard for securing payments against B2B fraud. Unlike solutions limited to a single database or validation network, nsKnox provides total global coverage to truly validate any bank account, anywhere, delivering the fastest and most accurate results possible.

    When other methods fall short, nsKnox uses authoritative data directly from the banking system to validate even out-of-network accounts.

    All nsKnox solutions are built on the patented Cooperative Cyber Security (CCS) technology, which protects payment information by distributing it across a decentralized network—making it cloud-proof and quantum-safe.

    Contact

    Assaf Dargan

    assaf.dargan@nsknox.net

    The post nsKnox Launches Adaptive Payment Security™, Revolutionizing B2B Fraud Prevention by Solving the ‘Impossible Triangle’ of Speed, Certainty, and Effor appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Ubiquiti’s UniFi Access application has been found vulnerable to a critical flaw that leaves its management API exposed without authentication.

    Discovered by Catchify Security, this issue allows malicious actors on the management network to potentially take full control of door access systems, raising alarms for organizations relying on the platform for physical security.

    The vulnerability stems from a misconfiguration introduced in version 3.3.22 of the UniFi Access app. Without proper safeguards, attackers could manipulate API endpoints to alter access controls, unlock doors, or disrupt operations.

    This exposure turns a routine network access into a gateway for unauthorized changes, especially in environments where physical and digital security intersect.

    UniFi Door Access App Vulnerability

    CVE-2025-52665 affects the UniFi Access Application specifically, targeting versions from 3.3.22 to 3.4.31.

    The flaw enables network-based exploitation with no privileges required, amplifying its danger in connected setups like corporate offices or smart buildings.

    Ubiquiti acknowledged the issue, noting it was patched in version 4.0.21, urging immediate updates to prevent exploitation.

    Security researchers at Catchify Security (@catchifySA) highlighted how the unauthenticated API could lead to cascading failures, such as unauthorized entry or data leaks from integrated systems.

    Rated at a perfect CVSS v3.1 score of 10.0, this critical vulnerability poses high risks across confidentiality, integrity, and availability.

    Attackers need only network access, making it straightforward for insiders or those who’ve breached perimeter defenses.

    CVE IDAffected ProductsCVSS v3.1 Base ScoreVector StringDescription
    CVE-2025-52665UniFi Access Application (v3.3.22 – 3.4.31)10.0 (Critical)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HUnauthenticated API exposure allowing full management control.

    Ubiquiti recommends updating to version 4.0.21 or later as the primary mitigation. Organizations should audit network configurations and monitor for unusual API activity in the interim.

    This incident underscores the need for robust authentication in IoT and access control software.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Ubiquiti UniFi Door Access App Vulnerability Exposes API Management Without Authentication appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Social media platform X is urging users who have enrolled for two-factor authentication (2FA) using passkeys and hardware security keys like Yubikeys to re-enroll their key to ensure continued access to the service. To that end, users are being asked to complete the re-enrollment, either using their existing security key or enrolling a new one, by November 10, 2025. “After November 10, if you

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Pentagon is still building up its naval forces in waters close to Venezuela, which has prompted officials in Caracas to decry recent joint exercises between the U.S. and troops from nearby Trinidad and Tobago, Reuters reported Sunday. 

    The latest public movements include rerouting the USS Gerald R. Ford aircraft-carrier strike group and its 5,000 or so troops from the Mediterranean to the Caribbean ostensibly to “bolster U.S. capacity to detect, monitor, and disrupt illicit actors,” as the Pentagon announced Friday. That’s on top of more than a half-dozen American warships already in the region. 

    “The U.S. hasn’t sent this many ships to the Caribbean since the Cuban missile crisis,” Nancy Youssef, Gisela Salim-Peyer, and Jonathan Lemire wrote for The Atlantic on Friday. 

    Notable: “The carrier strike group also provides far more firepower than is necessary for the occasional attack on narco-trafficking targets. But the ships could be ideal for launching a steady stream of air strikes inside Venezuela,” the three reporters wrote. 

    The U.S. has attacked at least 10 boats off the coast of Latin America since September, killing more than three dozen people. The White House says the people killed were drug traffickers and “terrorists,” but U.S. officials have not offered evidence to support their claims for each attack—which critics say amount to extrajudicial killings circumventing the laws of war.  

    Expert reax: “The only thing you could use the carrier for is attacking targets ashore, because they are not going to be as effective at targeting small boats at sea,” said retired Navy officer Bryan Clark of the Hudson Institute. However, “If you are striking inside Venezuela, the carrier is an efficient way to do it due to the lack of basing in the region,” he said. 

    Related:Venezuela’s Maduro says the US is fabricating a war and seeks to revoke citizenship of opponent,” the Associated Press reported Saturday.

    A U.S. aircraft carrier lost two aircraft in separate incidents just 30 minutes apart Sunday afternoon in the South China Sea. Fortunately, all five crew members were safely recovered by search-and-rescue personnel from the USS Nimitz (CVN 68).

    Involved: A Navy MH-60R Sea Hawk helicopter and an F/A-18F Super Hornet fighter jet. The helicopter went down first at about 2:45 p.m. local during “routine operations” in the region, and the jet also “went down in the waters of the South China Sea while conducting routine operations from Nimitz,” the U.S. Navy’s Pacific Fleet announced on social media. 

    It’s unclear what caused the apparent accidents, and both episodes are under investigation, officials said Sunday. 

    Nimitz entered the South China Sea 10 days ago. The carrier strike group has been deployed since late March, when the Nimitz departed its home port in Washington state’s Naval Base Kitsap for operations against the Houthis in Yemen, according to USNI News.  

    For what it’s worth, “The incidents came while President Donald Trump was on a visit to Asia,” Reuters reports. Trump told reporters Monday the episodes may have resulted from “bad fuel” and not foul play, though he did not elaborate, the Associated Press reports.  

    Update: The 9th Circuit appeals court reversed last week’s victory for the White House in one of its National Guard cases. The reversal came after the discovery process revealed Justice Department lawyers lied about troop numbers in Oregon, Law and Crime reported Saturday. 

    The findings hinged on an alleged forced redeployment of 115 Federal Protection Service officers to Portland, Ore. However, “discovery showed deployments of 27 troops, 31 troops, 29 troops, and 20 troops in Portland at any given time between the middle of June and end of October,” Law and Crime writes.  

    Now what? “The National Guard will not be deployed to Portland, at least until Tuesday, while the 9th Circuit Court of Appeals decides whether to rehear the case” on Tuesday, Portland’s KGW8 news reports. Read more, including background about the case, in Willamette Week

    Additional reading: 


    Welcome to this Monday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 2019, ISIS leader Abu Bakr al-Baghdadi killed himself during a U.S. military raid in northwestern Syria. 

    Industry

    Firms large and small are building prototypes with their own money. It’s not a new development, but it seems to be happening more than ever, as companies chase new acquisition priorities and look to displace established programs. Lockheed Martin says it’s honing a five-year shift in its R&D approach, while far smaller startups are looking to impress. Defense One’s Lauren C. Williams reports, here.

    China is applying DeepSeek, its homegrown AI model, to drones and battlefield robots, Reuters reports off a review of “hundreds of research papers, patents and procurement records” that give “a snapshot of the systematic effort by Beijing to harness AI for military advantage.” Among the new DeepSeek-powered products is the P60, a “military vehicle capable of autonomously conducting combat-support operations at 50 kilometres per hour.” Read on, here.

    If that’s your cup of tea, do a deep dive into back editions of The China Intelligence, a column by Peter Singer and BluePath Labs that mines open-source documents for news about China’s military development. Find those, here.

    Additional reading: 

    Around the world

    Russia says a nuclear-powered cruise missile has flown for 15 hours, covering 8,700 miles. “Little is known about the Burevestnik, which was code-named Skyfall by NATO, and many Western experts have been skeptical about it, noting that a nuclear engine could be highly unreliable,” the Associated Press reported off a video released Sunday that purports to show Russian leader Vladimir Putin reading a report by Gen. Valery Gerasimov, Russia’s chief of general staff.

    Trendspotting: “Russia continues to issue explicit nuclear threats as part of a multi-pronged effort seeking to deter continued US pressure on Russia and support for Ukraine,” analysts at the Washington-based Institute for the Study of War wrote in their latest battlefield assessment Sunday. 

    What’s going on: “Russia has been trying to use a combination of carrots and sticks unrelated to the war in Ukraine, such as bilateral arms control talks, to push the United States to give in to concessions about the war,” ISW writes. 

    Frontline update: Russian and Ukrainian forces are still battling over the strategically located city of Pokrovsk, Reuters reported Monday from Kyiv. “Russia has been trying to occupy Pokrovsk, a key part of Kyiv's defensive lines, for months, seeing it as a crucial point for its push to fully capture the Donetsk region…Over the past week, Ukrainian open-source mapping project Deep State expanded the grey area to the southwest of Pokrovsk and now shows around one-fifth of the city's west and south as contested area.” 

    Unrelated additional reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • London, United Kingdom, October 27th, 2025, CyberNewsWire 1inch, the leading DeFi ecosystem, has adopted Innerworks’ advanced device intelligence and RedTeam ethical hacking platform to strengthen security. By tapping into Innerworks’ predictive AI solution, the companies are building a proactive immune system and setting the gold standard for DeFi. DeFi’s growth and evolution has led to […]

    The post 1inch partners with Innerworks to strengthen DeFi security through AI-Powered threat detection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Predatory Sparrow has emerged as one of the most destructive cyber-sabotage groups targeting critical infrastructure across the Middle East, with operations focused primarily on Iranian and Syrian assets.

    The hacktivist group, believed to be affiliated with Israeli interests, has orchestrated a series of devastating cyberattacks spanning from 2019 to 2025, targeting railways, steel plants, financial institutions, and fuel distribution networks.

    Their campaigns are characterized by deliberate data destruction, operational paralysis, and provocative public messaging designed to maximize psychological impact alongside physical disruption.

    The group’s operational timeline reveals an escalating pattern of sophistication and destruction. Early attacks in 2019-2020 targeted Syrian entities including Alfadelex Trading and Cham Wings Airlines, establishing their capabilities in network infiltration.

    However, their most significant operation came in July 2021 when they deployed the “Meteor” wiper malware against Iran’s national railway system, causing widespread service disruptions and displaying taunting messages on station boards.

    This attack demonstrated their ability to compromise critical national infrastructure with precision timing.

    More recently, Predatory Sparrow has expanded their targeting to include financial infrastructure with devastating effect.

    Following Israeli airstrikes on Iran in June 2025, the group launched coordinated attacks against Bank Sepah and the Nobitex cryptocurrency exchange.

    In the Nobitex breach, they claimed to have rendered $90 million in cryptocurrency permanently unrecoverable by transferring assets to inaccessible addresses, while simultaneously leaking the exchange’s complete source code and infrastructure documentation.

    Picussecurity analysts identified the group’s sophisticated multi-stage attack methodology during investigations into the Iranian railway incident.

    Their analysis revealed that Predatory Sparrow employs a complex chain of batch scripts and encrypted payloads to establish persistence, disable defenses, and deploy destructive wipers.

    The group demonstrates advanced environmental awareness by conducting reconnaissance to identify specific target systems before payload execution.

    Technical Execution and Wiper Deployment Mechanisms

    The technical architecture of Predatory Sparrow’s attacks centers on their custom Meteor wiper malware, which utilizes encrypted configuration files and multi-stage batch script execution.

    The attack chain begins with a setup.bat script that performs hostname verification against specific Passenger Information System servers (PIS-APP, PIS-MOB, WSUSPROXY, PIS-DB), ensuring malicious payloads avoid execution on display systems while guaranteeing the attacker’s messaging appears on public-facing boards.

    The msrun.bat script serves as the deployment mechanism for the wiper payload, creating a scheduled task configured to execute at 23:55:00 through Windows Task Scheduler.

    Prior to wiper execution, the cache.bat script systematically disables all network adapters using PowerShell commands:-

    powershell -Command "Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }" > NUL

    Defense evasion techniques include clearing Windows Event Logs through wevtutil commands targeting Security, System, and Application logs, effectively erasing forensic evidence:

    wevtutil cl system
    wevtutil cl application
    wevtutil cl security

    The Meteor wiper employs XOR-based encryption for its configuration file (msconf.conf) and log files. Researchers developed Python decryption utilities revealing the malware’s internal operations:

    from malduck import xor, u32
    
    def decode_buffer(buf, key):
        results = ""
        for k,v in enumerate(buf):
            results += chr(((k % 256) + key[k % len(key)] ^ v) & 0xff)
        return results

    To ensure complete system destruction, the bcd.bat script manipulates boot configuration data and removes volume shadow copies, preventing recovery:

    vssadmin.exe delete shadows /all /quiet
    wmic.exe shadowcopy delete

    This comprehensive approach to data destruction and system sabotage demonstrates Predatory Sparrow’s focus on causing irreversible damage rather than data exfiltration, aligning with their stated mission of retaliatory cyber warfare against Iranian interests.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Predatory Sparrow Group Attacking Critical Infrastructure to Destroy Data and Cause Disruption appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • London, United Kingdom, October 27th, 2025, CyberNewsWire

    1inch, the leading DeFi ecosystem, has adopted Innerworks’ advanced device intelligence and RedTeam ethical hacking platform to strengthen security.

    By tapping into Innerworks’ predictive AI solution, the companies are building a proactive immune system and setting the gold standard for DeFi.

    DeFi’s growth and evolution has led to increased pressure from threat actors.

    While 1inch maintains an extensive and secure defense, the rapid pace of change among hackers means the project must adapt just as quickly.

    By deploying Innerworks’ intelligent predictive solutions, 1inch can now leverage AI to stay ahead of emerging threats.

    Rather than waiting for attacks, Innerworks proactively unmasks hacker playbooks and feeds this intelligence directly into 1inch’s defences.

    As criminals increasingly use AI to mimic human behavior online, Innerworks leverages the same frontier AI methods to anticipate and neutralize these synthetic threats before they can scale, all happening seamlessly in the background, with zero user input required.

    By adopting Innerworks, 1inch is not only hardening its own platform but also leading an industry-wide shift toward collective resilience.

    Sergej Kunz, Co-Founder of 1inch, said: “We’re flipping the script on hackers. By leveraging AI to anticipate their movements, we can proactively adapt our defenses to meet emerging threats head-on. This commitment to continuous testing and improvement is what makes 1inch one of the most secure DeFi projects today.”

    Oli Quie, CEO of Innerworks, stated: “Hackers are no longer just human – they are synthetic, powered by AI, and capable of breaching every mainstream solution. RedTeam proves this with a 99% bypass rate. By partnering with 1inch, we are converting this intelligence into a collective immune system that defends crypto — and eventually, the wider internet.”

    About Innerworks

    Innerworks is building the immune system for the internet. Its Synthetic Threat Intelligence platform leverages ethical hacking, behavioural AI, and decentralised training to identify and neutralise the world’s most advanced fraud and bot attacks.

    Trusted by leading financial and Web3 organisations, Innerworks delivers seamless, invisible defences that safeguard digital economies at scale.

    About 1inch

    1inch accelerates decentralized finance with a seamless crypto trading experience for 25M users.

    Beyond being the top platform for low-cost, efficient token swaps with $500M+ in daily trades, 1inch offers a range of innovative tools, including a secure self-custodial wallet, a portfolio tracker for managing digital assets, a dedicated business portal giving access to its cutting-edge technology, and even a debit card for easy crypto spending.

    By continuously innovating, 1inch is simplifying DeFi for everyone. 

    Website | 1inch Business | Follow on X | Explore Blog

    Contact

    PR lead

    Pavel Kruglov

    1inch

    p.kruglov@1inch.com

    The post 1inch partners with Innerworks to strengthen DeFi security through AI-Powered threat detection appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The latest 2025 Broadband Genie router security survey reveals alarming trends in network security awareness among internet users. This year’s results, while showing marginal improvements in some areas, underscore the persistent gap between knowing how to secure a network and actually taking action. The research team conducted their fourth comprehensive router security survey to compare […]

    The post Hackers Target 81% of Routers with Default Admin Passwords appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The latest 2025 Broadband Genie router security survey reveals alarming trends in network security awareness among internet users. This year’s results, while showing marginal improvements in some areas, underscore the persistent gap between knowing how to secure a network and actually taking action. The research team conducted their fourth comprehensive router security survey to compare […]

    The post Hackers Target 81% of Routers with Default Admin Passwords appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical vulnerability in OpenAI’s newly launched ChatGPT Atlas browser enables attackers to inject malicious instructions into ChatGPT’s memory and execute remote code on user systems.

    This flaw, uncovered by LayerX, exploits Cross-Site Request Forgery (CSRF) to hijack authenticated sessions, potentially infecting devices with malware or granting unauthorized access. The discovery highlights escalating risks in agentic AI browsers, where integrated LLMs amplify traditional web threats.​

    Reported to OpenAI under responsible disclosure protocols, the vulnerability affects ChatGPT users across browsers but poses heightened dangers for Atlas adopters due to its always-on authentication and weak phishing defenses.

    LayerX’s tests revealed that Atlas blocks only 5.8% of phishing attempts, compared to 47-53% for Chrome and Edge, making its users up to 90% more exposed. While OpenAI has not publicly detailed patches, experts urge immediate mitigations like enhanced token validation.​

    How the CSRF Exploit Targets ChatGPT Memory

    The attack begins with a user logged into ChatGPT, storing authentication cookies or tokens in their browser. Attackers lure victims to a malicious webpage via phishing links, which then trigger a CSRF request leveraging the existing session.

    This forged request injects hidden instructions into ChatGPT’s “Memory” feature, designed to retain user preferences and context across sessions without explicit repetition.​

    Unlike standard CSRF impacts like unauthorized transactions, this variant targets AI systems by tainting the LLM’s persistent “subconscious.”

    Once embedded, malicious directives activate during legitimate queries, compelling ChatGPT to generate harmful outputs such as remote code fetches from attacker-controlled servers. The infection persists across devices and browsers tied to the account, complicating detection and remediation.​

    The attached diagram illustrates the attack flow: from credential hijacking to memory injection and remote execution.

    Atlas’s default login to ChatGPT keeps credentials readily available, streamlining CSRF exploitation without additional token phishing.

    LayerX evaluated Atlas against 103 real-world attacks, finding it permitted 94.2% to succeed, far worse than competitors like Perplexity’s Comet, which failed 93% in prior tests. This stems from the absence of built-in protections, turning the browser into a prime vector for AI-specific threats like prompt injection.​

    Broader research echoes these concerns; Brave’s analysis of AI browsers, including Atlas, exposed indirect prompt injections that embed commands in webpages or screenshots, leading to data exfiltration or unauthorized actions.

    OpenAI’s agentic features, allowing autonomous tasks, exacerbate risks by granting the AI decision-making power over user data and systems.​

    Proof-of-Concept: Malicious ‘Vibe Coding’

    In a demonstrated scenario, attackers target “vibe coding,” where developers collaborate with AI on high-level project intents rather than rigid syntax.

    Injected memory instructions subtly alter outputs, embedding backdoors or exfiltration code in generated scripts, such as pulling malware from a server like “server.rapture.”​

    ChatGPT may issue subtle warnings, but sophisticated masking often evades them, allowing seamless delivery of tainted code. Users downloading these scripts risk system compromise, underscoring how AI flexibility invites abuse.

    This PoC aligns with emerging exploits in tools like Gemini, where similar injections access shared corporate data.​

    As AI browsers proliferate, vulnerabilities like this demand robust safeguards beyond basic browser tech. Enterprises should prioritize third-party extensions for visibility, while users enable multi-factor authentication and monitor sessions.

    LayerX’s findings reinforce that without swift updates, Atlas could redefine AI security pitfalls.​

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post OpenAI Atlas Browser Vulnerability Allows Malicious Code Injection into ChatGPT appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶