• GitHub repositories for malware delivery through sophisticated weaponized LNK files, according to recent analysis by S2W’s Threat Intelligence Center, TALON. This campaign demonstrates the group’s evolving tactics in leveraging trusted platforms to bypass security measures and establish persistent access to victim systems. The attack chain begins with a malicious ZIP archive named “NTS_Attach.zip” containing a […]

    The post GitHub Abused by Kimsuky Hackers Delivering Malware Through LNK Files appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Gentlemen ransomware group has emerged as a sophisticated threat actor, demonstrating advanced capabilities through systematic compromise of enterprise environments across 17 countries. Their campaign combines legitimate driver abuse, Group Policy manipulation, and custom anti-AV utilities to bypass enterprise endpoint protections, targeting manufacturing, construction, healthcare, and insurance sectors. In August 2025, cybersecurity researchers identified a […]

    The post Gentlemen Ransomware Exploits Drivers and Group Policies to Breach Organizations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Major enterprise software provider Workday has disclosed a significant security incident that exposed customer data through a compromised third-party application, affecting business contact information and support case details. Third-Party Security Breach On August 23, 2025, Workday discovered a critical security vulnerability in Salesloft’s Drift application, a third-party tool integrated with Salesforce systems. The cloud-based human […]

    The post Workday Data Breach Exposed Customer Data and Case Details appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google has released an urgent security update for Chrome to address two significant vulnerabilities, including a critical remote code execution flaw that could allow attackers to completely compromise user systems. The stable channel update brings Chrome to version 140.0.7339.127/.128 for Windows, 140.0.7339.132/.133 for Mac, and 140.0.7339.127 for Linux. Critical ServiceWorker Vulnerability Patched The most severe […]

    The post Chrome Security Update Fixes Critical Remote Code Execution Flaw appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • NATIONAL HARBOR, Md.—Within just a few months, the country’s largest military shipbuilder aims to have its shipyard employees taking direction from AI.

    “By the end of this year, our plan is to have every single person in our manufacturing shops—17 different businesses, basically across 550 acres—doing work based on the output of what AI tells us to go do. At the end of [2026] all of the people working on all of our ships will be directed by what AI tells us to do,” Brian Fields, the chief technology officer for HII’s Newport News Shipbuilding division, said at C3 AI’s federal event on Tuesday. “So we're jumping in the deep end of the pool… If we don't do something rapidly, we are not going to supply the Navy with the ships they need.”

    HII, which has been leaning into emerging technologies, inked a deal with C3 AI earlier this year to use agentic AI, which uses automation to learn and make decisions once given specific goals, to help the shipbuilder meet its goals of a 20-percent increase in production. 

    “We have 17 different shops: 2,300 people. They have to do 5,200 jobs a week, and each one of those jobs has 32 different data sources. So you're talking hundreds of thousands of decisions…to be made by about 100 people in spreadsheets. The results you have are really built on the process you have. And we need a new process,” Fields said.

    The push for using AI in shipbuilding comes as the White House and Navy leaders demand faster production times for nuclear-capable submarines. 

    Stephen Ehikian, C3 AI’s new CEO, said the company’s platform creates a kind of “digital twin” of the shipbuilding process and can run “virtual simulations,” including scenario planning and risk assessment. 

    “We showed agentic process automation, workflow automation, as well as ability to build actual applications,” Ehikian, who was most recently the acting and deputy administrator for the General Services Administration, told reporters. “The whole market is moving towards seeing actual outcomes. The applications are the most valuable piece of this.” 

    Newport News plans to use AI to pinpoint production chokepoints in submarine production. 

    “If all you're doing is moving data around to try to keep the systems working, I'd much rather automate that, because we got way too many people that are in that side of the business, and I'd rather have them helping us build ships more efficiently,” Fields told reporters.

    “The thing that keeps us from building submarines at the pace that they need to be built right now comes down to 17 parts. Seventeen parts drive an enormous increase in submarine build, and those 17 parts come from a foundry that isn't able to get us the parts to put one piece of complex equipment together. So we're in the midst right now of using that data and aggressively working with the Navy to go print those parts and radically change how we deliver submarine builds.” 

    The goal is for AI to pull information from disparate sources including spreadsheets, analytics, accounting and scheduling systems. That analysis will in turn—and over time—help shipbuilders “make the right stuff in the right order to give the ship assembly teams the best chance to deliver the ships on time. And that's a long process,” Fields said.

    And there’s also the challenge of getting the workforce to trust and use the tools. 

    “When you get down into our shops, there's a lot of pride about how they do their work,” Fields said during the event. “One of our work streams is process and behaviors, and we've put some strong leaders in that to really drive the leadership in those shops to say, ‘We own this; we're going to get the value out of it.’”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Workday has confirmed it suffered a data breach after a security incident involving a third-party application that compromised customer information.

    The breach originated from Salesloft’s Drift application, which connects to Salesforce environments.

    On August 23, 2025, Workday became aware of the issue and immediately disconnected the app, invalidated its access tokens, and initiated an investigation with the support of an external forensics firm. The incident highlights the persistent risks associated with third-party integrations in enterprise environments.

    The root cause of the breach was a compromise within Salesloft’s systems. On August 26, 2025, Salesloft confirmed that a threat actor had breached its infrastructure, obtained OAuth credentials, and used them to execute searches within its customers’ Salesforce environments.

    Workday’s own investigation confirmed that its Salesforce instance was impacted by this unauthorized access.

    In response, Workday promptly began evaluating all of its vendors that utilize the Drift application to assess the full scope of the incident and prevent further unauthorized activity. The company emphasized that its core customer tenants were not directly accessed or compromised through this vector.

    Data Exposed

    According to Workday’s investigation, which a third-party forensics firm verified, the threat actor’s access was limited to a very small subset of information stored within its Salesforce environment.

    The exposed data includes business contact information, basic support case details, tenant-related attributes such as tenant and data center names, product and service names, training course records, and event logs.

    Crucially, the threat actor did not gain access to sensitive external files like contracts, order forms, or any attachments that customers may have included in support cases.

    Workday is proactively searching all support cases for any credentials that may have been inadvertently shared and will notify affected customers directly.

    Out of an abundance of caution, Workday is strongly urging all customers to immediately rotate any credentials that may have been shared with its support teams through a support case.

    The company reiterated its advice that customers should never include sensitive information, such as login credentials, in support tickets.

    In addition to this primary recommendation, Workday advised customers to follow security best practices, including the mandatory use of multi-factor authentication, conducting regular phishing awareness training for employees, and actively monitoring user activity for any signs of suspicious behavior. Salesloft has also published its own security recommendations for customers to review.

    Confirmed victims of this supply chain attack include:

    • Palo Alto Networks: The cybersecurity firm confirmed the exposure of business contact information and internal sales data from its CRM platform.
    • Zscaler: The cloud security company reported that customer information, including names, contact details, and some support case content, was accessed.
    • Google: In addition to being an investigator, Google confirmed a “very small number” of its Workspace accounts were accessed through the compromised tokens.
    • Cloudflare: Cloudflare has confirmed a data breach where a sophisticated threat actor accessed and stole customer data from the company’s Salesforce instance.
    • PagerDuty has confirmed a security incident that resulted in unauthorized access to some of its data stored in Salesforce.
    • Tenable has confirmed a data breach that exposed the contact details and support case information of some of its customers.
    • Qualys has confirmed it was impacted by a widespread supply chain attack that targeted the Salesloft Drift marketing platform, resulting in unauthorized access to a portion of its Salesforce data.
    • Dynatrace has confirmed it was impacted by a third-party data breach originating from the Salesloft Drift application, resulting in unauthorized access to customer business contact information stored in its Salesforce CRM.
    • Elastic has disclosed a security incident stemming from a third-party breach at Salesloft Drift, which resulted in unauthorized access to an internal email account containing valid credentials.

    Find this Story Interesting! Follow us on Google NewsLinkedIn, and X to Get More Instant Updates.

    The post Workday Confirms Data Breach – Hackers Accessed Customers Data and Case Information appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google has issued an urgent security update for the Chrome browser on Windows, Mac, and Linux, addressing a critical vulnerability that could allow attackers to execute arbitrary code remotely.

    Users are strongly advised to update their browsers immediately to protect against potential threats.

    The Stable channel has been updated to version 140.0.7339.127/.128 for Windows, 140.0.7339.132/.133 for Mac, and 140.0.7339.127 for Linux.

    The update is currently rolling out and will become available to all users over the coming days and weeks. This patch follows the initial release of Chrome 140, which also addressed several other security issues.

    CVE IDSeverityDescriptionAffected ComponentBug Bounty
    CVE-2025-10200CriticalUse-after-freeServiceworker$43,000
    CVE-2025-10201HighInappropriate implementationMojo$30,000

    Critical Use-After-Free Vulnerability

    The update resolves two major security flaws, with the most severe being CVE-2025-10200. This vulnerability is rated as critical and is described as a “Use-after-free” bug in the Serviceworker component.

    A use-after-free flaw occurs when a program tries to use memory after it has been deallocated, which can lead to crashes, data corruption, or, in the worst case, arbitrary code execution.

    An attacker could exploit this vulnerability by crafting a malicious webpage that, when visited by a user, could allow the attacker to run malicious code on the victim’s system.

    Security researcher Looben Yang reported this critical flaw on August 22, 2025. In recognition of the severity of the discovery, Google has awarded a bug bounty of $43,000.

    High-Severity Mojo Implementation Flaw

    The second vulnerability patched in this release is CVE-2025-10201, a high-severity flaw identified as an “Inappropriate implementation in Mojo.”

    Mojo is a collection of runtime libraries used for inter-process communication within Chromium, the open-source project that powers Chrome.

    Flaws in this component can be particularly dangerous as they can potentially compromise the browser’s sandbox, a key security feature that isolates processes to prevent exploits from affecting the underlying system.

    This vulnerability was reported by Sahan Fernando and an anonymous researcher on August 18, 2025. The reporters were awarded a $30,000 bounty for their findings.

    Google is rolling out the update gradually, but users can manually check for and apply the update by navigating to Settings > About Google Chrome.

    The browser will automatically scan for the latest version and prompt the user to relaunch it to complete the update process.

    As is standard practice, Google has restricted access to detailed information about the bugs to prevent attackers from developing exploits before a majority of users have installed the patch. This highlights the importance of applying security updates as soon as they become available.

    Find this Story Interesting! Follow us on Google NewsLinkedIn, and X to Get More Instant Updates.

    The post Chrome Security Update Patches Critical Remote Code Execution Vulnerability appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Apple Podcasts

    Guests:

    • Sam Bendett, advisor in Russia Studies at the Virginia-based research organization CNA;
    • And Patrick Tucker, Defense One science and technology editor.
    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if successfully exploited, could allow attackers to take control of customer accounts. The vulnerability, tracked as CVE-2025-54236 (aka SessionReaper), carries a CVSS score of 9.1 out of a maximum of 10.0. It has been described as an improper input validation flaw. Adobe said it’s not aware of

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • SAP on Tuesday released security updates to address multiple security flaws, including three critical vulnerabilities in SAP Netweaver that could result in code execution and the upload arbitrary files. The vulnerabilities are listed below – CVE-2025-42944 (CVSS score: 10.0) – A deserialization vulnerability in SAP NetWeaver that could allow an unauthenticated attacker to submit a malicious

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶