Chinese state-linked hackers have exploited a zero-day vulnerability in VMware ESXi during espionage operations aimed at U.S. law firms, according to CrowdStrike’s latest assessment of threats affecting the legal sector. The activity is attributed to WARP PANDA, a China-nexus adversary that deployed malware in victims’ VMware vCenter environments. This series of intrusions, which continued into […]

The post Chinese Hackers Exploit VMware ESXi Zero-Day to Target Law Firms in Cyber Espionage Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Apple has released updates for iOS 18.7.11 and iPadOS 18.7.11 to address three security vulnerabilities, including a CoreGraphics flaw connected to sophisticated targeted attacks. These updates were released on October 26, 2026, and also resolve information disclosure and unauthorized camera access issues affecting the Audio and CoreMedia components. The most significant vulnerability, tracked as CVE-2026-86950, […]

The post Apple Fixes Actively Exploited iOS Zero-Day Vulnerability in CoreGraphics appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers are exploiting a command injection vulnerability (CVE-2026-73570) in the Zimbra Collaboration Suite. This vulnerability allows attackers to compromise internet-facing email servers without any user interaction. Microsoft Threat Intelligence has observed attackers deploying webshells, escalating privileges, collecting authentication secrets, and staging mailbox data across organizations in various regions and industries. Zimbra Zero-Click Flaw The “zero-click” […]

The post Hackers Exploit Zimbra Zero-Click Flaw to Take Control of Email Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Corelight researchers have disclosed a Windows Server vulnerability that lets attackers with network access crash affected systems with a single malicious DFS referral response. This vulnerability, tracked as CVE-2026-70111, affects Windows Server versions 2019, 2022, and 2025. According to Corelight’s disclosure on October 13, Microsoft addressed the flaw in its October 2026 updates. Notably, there […]

The post Windows Server Zero-Day Flaw Lets Attackers Crash Servers With a Single Malicious Packet appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Attackers chained three zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances to execute commands as root without authentication, then searched the affected network for credentials and sensitive Active Directory data. Volexity attributed the activity to an unknown threat actor it tracks as UTA0576, which repeatedly exploited an appliance running version 22.8R2.4, Build 19097 the […]

The post Hackers Chain 3 Ivanti VPN Zero-Days to Gain Root Access Without Authentication appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.