Citrix has released security updates for XenServer versions 8.4 and 9 to address a critical vulnerability. This flaw could allow an unauthenticated attacker on the management network to compromise virtualization hosts. The Cloud Software Group published a bulletin (CTX697256) on November 3, 2026, classifying the issue as Critical. The bulletin covers nine CVEs. Citrix XenServer […]

The post Critical Citrix XenServer Flaw Allows Unauthenticated Attackers to Take Control of Virtualization Hosts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google released its November 2026 Android Security Bulletin, which addresses critical vulnerabilities that could allow remote code execution without user interaction or additional execution privileges. Published on November 2, the bulletin highlights a framework vulnerability as the most severe issue and also documents other critical remote code execution flaws in Android’s system components. According to […]

The post Google Patches Critical Android RCE Flaws That Let Attackers Execute Code Without User Interaction appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a WordPress Core vulnerability in its Known Exploited Vulnerabilities catalog due to evidence of active exploitation. This vulnerability, identified as CVE-2026-119977, allows unauthenticated attackers to execute server-side code during a specific software upgrade window. CISA added this vulnerability to the catalog on November 3, 2026, […]

The post CISA Warns of Active Attacks Exploiting WordPress Core Code Execution Vulnerability appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cloudflare launched Zero Wire, a public vulnerability intelligence hub that helps security teams investigate critical internet threats, assess exploitation evidence, and prioritize remediation efforts. Available through Cloudflare Radar, the service combines technical research, vendor guidance, and network observations into concise briefings. Cloudflare’s launch announcement positions the platform as a practical starting point for organizations facing […]

The post Cloudflare Launches Zero Wire to Track Critical Vulnerabilities and Active Exploitation Across the Internet appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Ubuntu has published fixes for CVE-2026-98432, a critical Linux kernel flaw in IPv4 TCP connection handling. It carries a CVSS 3.1 score of 9.8 and can lead to remote code execution. The fixes for Ubuntu 22.04 LTS and newer are in the -proposed pocket, so they are not yet in the default updates channel. Critical […]

The post Ubuntu Releases Security Fixes for Critical Linux Kernel Vulnerability Allowing Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that CVE-2026-97229, a critical vulnerability affecting both GitLab Community Edition and Enterprise Edition, is actively being exploited. On October 29, 2026, CISA added this flaw to its Known Exploited Vulnerabilities catalog, increasing the urgency for organizations running affected servers to take action. This vulnerability allows unauthenticated […]

The post CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers exploited a chain of zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances, allowing them to execute commands with root access, steal credentials, and probe internal networks. Volexity has identified the unknown attacker as UTA0576 and traced the exploitation back to October 3, 2026, targeting an appliance that was fully patched at the time. […]

The post Hackers Exploit Ivanti Connect Secure Zero-Day Vulnerabilities to Gain Root Access and Steal Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Chinese state-linked hackers have exploited a zero-day vulnerability in VMware ESXi during espionage operations aimed at U.S. law firms, according to CrowdStrike’s latest assessment of threats affecting the legal sector. The activity is attributed to WARP PANDA, a China-nexus adversary that deployed malware in victims’ VMware vCenter environments. This series of intrusions, which continued into […]

The post Chinese Hackers Exploit VMware ESXi Zero-Day to Target Law Firms in Cyber Espionage Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Veeam has released security updates to address a critical authorization bypass vulnerability in Backup & Replication. This flaw, tracked as CVE-2026-108142, allows an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. The vulnerability has a CVSS v4.0 score of 9.1 and affects both Windows deployments and the Veeam Software Appliance. The company disclosed […]

The post Critical Veeam Backup & Replication Flaw Allows Unauthenticated Attackers to Bypass Authorization appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

HashiCorp disclosed a vulnerability in consul-k8s, a cross-namespace authorization bypass that could let attackers with limited Kubernetes permissions gain elevated Consul privileges. This vulnerability is tracked as CVE-2026-110720 and affects component access control list (ACL) binding rules when automated system ACL management is enabled. HashiCorp published advisory HCSEC-2026-50 on October 26, 2026, and released fixes […]

The post HashiCorp Consul Vulnerability Allows Attackers to Bypass Authorization and Gain Elevated Privileges appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Apple has released updates for iOS 18.7.11 and iPadOS 18.7.11 to address three security vulnerabilities, including a CoreGraphics flaw connected to sophisticated targeted attacks. These updates were released on October 26, 2026, and also resolve information disclosure and unauthorized camera access issues affecting the Audio and CoreMedia components. The most significant vulnerability, tracked as CVE-2026-86950, […]

The post Apple Fixes Actively Exploited iOS Zero-Day Vulnerability in CoreGraphics appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

KeePassXC has released version 2.8.0 to address multiple security vulnerabilities related to database imports, browser integration, SSH key handling, and the protection of sensitive information. Published on October 21, this update includes eight security fixes, platform improvements, and a migration to Qt 6. Notably, one vulnerability is identified as CVE-2026-69150, and four additional issues are […]

The post KeePassXC 2.8.0 Released to Fix Multiple Security Vulnerabilities Affecting Password Manager appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Apache Camel’s security advisories document critical and high-severity vulnerabilities that could allow for remote code execution, authentication bypass, credential exposure, and unauthorized file access. These issues affect various integration components and Camel K, and their exploitability depends on the deployed components, route configurations, and an attacker’s access to messages or infrastructure. The vulnerabilities involve unsafe […]

The post Apache Camel Vulnerabilities Allow Remote Code Execution, Authentication Bypass, and Data Theft appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical command execution vulnerability has been identified in Okta Access Gateway (OAG), which could allow an authenticated administrator to execute system commands by submitting specially formatted configuration values through the appliance’s Admin Console. This vulnerability is documented in an advisory dated October 22, 2026. Tracked as CVE-2026-115547, the issue affects versions of the OAG […]

The post Critical Okta Access Gateway Vulnerability Enables Remote Command Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hewlett Packard Enterprise (HPE) has addressed a critical authentication-bypass vulnerability in the SSH daemon of its AOS-8 wireless operating system. This vulnerability, tracked as CVE-2026-79855, could let a remote, unauthenticated attacker gain administrative privileges and fully compromise an affected host. It has a CVSS v3.1 score of 9.8, indicating a high severity. Attackers can exploit […]

The post Critical HPE Aruba AOS-8 Flaw Allows Hackers to Bypass SSH Authentication and Take Over Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Fortinet has announced coordinated security hardening updates for FortiOS, FortiManager, and FortiAnalyzer, scheduled for October 22, 2026. These updates aim to address critical and high-severity vulnerabilities. The company urges customers to prioritize updating internet-facing systems and treat these upgrades as urgent, not routine maintenance. In an announcement on October 21, Fortinet’s Chief Information Security Officer, […]

The post Fortinet Releases Critical Security Updates for FortiOS, FortiManager, and FortiAnalyzer appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google released Chrome version 156 to the stable channel for Windows, macOS, and Linux, addressing 353 security vulnerabilities, including six critical flaws. Announced on October 20, 2026, this update addresses memory corruption, use-after-free errors, input validation issues, and other weaknesses across various browser components. Google stated that the deployment will continue over the coming days […]

The post Google Chrome 156 Fixes 353 Security Vulnerabilities, Including 6 Critical Flaws appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Horizon3.ai has released a public proof-of-concept exploit for CVE-2026-106173, a critical vulnerability in Fortinet FortiSIEM. This vulnerability allows unauthenticated attackers to turn arbitrary file writes into remote code execution. Researcher Zach Hanley published a technical analysis on October 20, following Fortinet’s security advisory released on October 13. The vulnerability specifically affects the product’s gRPC communication […]

The post Critical Fortinet FortiSIEM RCE Vulnerability Gets Public PoC Exploit, Allowing Unauthenticated Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Oracle has released its October 2026 Critical Patch Update, which includes 1,295 new security patches across its enterprise portfolio. Published on October 20, the advisory addresses vulnerabilities in Oracle software as well as third-party components. Notably, it addresses critical flaws that attackers can exploit remotely without authentication. Affected products include databases, middleware, business applications, Java, […]

The post Oracle Releases 1,295 Security Patches to Fix Critical Vulnerabilities Across Multiple Products appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Ransomware operators are exploiting a vulnerability in Palo Alto Networks PAN-OS that allows them to bypass authentication. This issue enables unauthorized VPN sessions, bypasses multifactor authentication (MFA), and allows access to corporate networks. According to Unit 42’s October 19 update, two groups, Spikey Scorpius (also referred to as Qilin) and Tarnished Scorpius, are using CVE-2026-0257. […]

The post Hackers Exploit Palo Alto Networks PAN-OS Flaw to Bypass MFA and Deploy Ransomware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.