GBHackers On Security

Publication

0 followers

Security news site covering daily hacking news and cyberattack updates.

NetSupport Manager 0-Day Vulnerabilities Enable Remote Code Execution

Security researchers uncovered two critical 0‑day flaws—CVE‑2025‑34164 and CVE‑2025‑34165—in NetSupport Manager versions up to 14.10.4.0. The bugs reside in an undocumented broadcast feature and can be chained to achieve unauthenticated remote code execution by corrupting heap memory and reading stack data. Exploitation bypasses ASLR, leaks vtable pointers, and grants attackers shell access on any machine reachable on TCP port 5405. NetSupport released a corrective update in version 14.12.0000 on July 29 2025.

Technology Pulse

GBHackers On Security

Recent Posts

NetSupport Manager 0-Day Vulnerabilities Enable Remote Code Execution

New Phishing Attack Exploits Vercel to Host and Deliver Remote Access Malware

TrustAsia Pulls 143 Certificates Following Critical LiteSSL ACME Vulnerability

NVIDIA CUDA Toolkit Flaw Allows Command Injection, Arbitrary Code Execution

BIND 9 Flaw Lets Attackers Crash Servers With Malicious DNS Records

PNB MetLife Phishing Attack: Multi-Stage Scheme Steals Data, Triggers UPI Payments

JA3 Fingerprinting Tool Exposes Attackers’ Infrastructure

New ClickFix Campaign Exploits Fake Verification Pages to Hijack Facebook Sessions

Malicious PyPI Package Impersonates Sympy-Dev, Targeting Millions of Users

ClearFake Malware Exploits Proxy Execution to Run Malicious PowerShell Commands via Trusted Windows Feature

ErrTraffic Exploits Visual Page Breaks to Fuel ClickFix Attacks, Rebranding Exploits as “GlitchFix”

Magecart Hack Injects JavaScript to Steal Online Payment Data

Threat Actors Exploit LinkedIn for RAT Delivery in Enterprise Networks

Apache Airflow Flaws Expose Sensitive Workflow Data to Potential Attackers

OPNsense 25.7.11 Enhances Network Visibility With Host Discovery Feature

TP-Link Router Flaw Enables Authentication Bypass Through Password Recovery Mechanism

Discord Exploited to Spread Clipboard Hijacker Stealing Cryptocurrency Funds

Cloudflare Zero-Day Flaw Allows Attackers to Bypass Security and Access Any Host

Visual Studio Code Abused in Sophisticated Multistage Malware Attacks

Cybercriminals Impersonate Malwarebytes to Steal User Credentials

Attackers Rerouted Employee Pay Without Breaching IT Systems

PDFSIDER Malware Actively Exploited to Evade Antivirus and EDR Defenses

Argus: Python-Based Recon Toolkit Aims to Boost Security Intelligence

Researchers Hijack Hacker Domain Using Name Server Delegation

Threat Actors Abuse Browser Extensions to Deliver Fake Warning Messages

How Security Teams Use IP Location and DNS History In Cybercrime Investigation

Critical XSS Vulnerabilities in Meta Conversion API Enable Zero-Click Account Takeover

Best Security Awareness Training Platforms For 2026

Promptware Kill Chain – Five-Step Kill Chain Model For Analyzing Cyberthreats

GoLogin vs MultiLogin vs VMLogin – What’s the Anti-Detect Browsers Difference?

Spring CLI Vulnerability Allows Attackers to Execute Commands on User Systems

Multiple Elastic Vulnerabilities Could Lead to File Theft and DoS

PowerShell-Driven Multi-Stage Windows Malware Using Text Payloads

HoneyTrap: Outsmarting Jailbreak Attacks on Large Language Models

Android Banking Malware deVixor Actively Targeting Users with Ransomware Capabilities.

Threat Actors Exploit RMM Tools Through Weaponized PDF Files

SAP January 2026 Security Patch Day Fixes Critical Injection and RCE Flaws

DPRK Hackers Earn $600M Posing as Remote Workers

Top 5 Best Free VPN for 2026 to Protect Your Anonymity on the Internet

Top 5 Best Cyber Attack Prevention Methods for Small Businesses With Breach & Attack Simulation

Malicious Chrome Extension Steals Wallet Credentials, Enables Automated Trading Abuse

Technology Pulse

GBHackers On Security

Recent Posts

NetSupport Manager 0-Day Vulnerabilities Enable Remote Code Execution

New Phishing Attack Exploits Vercel to Host and Deliver Remote Access Malware

TrustAsia Pulls 143 Certificates Following Critical LiteSSL ACME Vulnerability

NVIDIA CUDA Toolkit Flaw Allows Command Injection, Arbitrary Code Execution

BIND 9 Flaw Lets Attackers Crash Servers With Malicious DNS Records

PNB MetLife Phishing Attack: Multi-Stage Scheme Steals Data, Triggers UPI Payments

JA3 Fingerprinting Tool Exposes Attackers’ Infrastructure

New ClickFix Campaign Exploits Fake Verification Pages to Hijack Facebook Sessions

Malicious PyPI Package Impersonates Sympy-Dev, Targeting Millions of Users

ClearFake Malware Exploits Proxy Execution to Run Malicious PowerShell Commands via Trusted Windows Feature

ErrTraffic Exploits Visual Page Breaks to Fuel ClickFix Attacks, Rebranding Exploits as “GlitchFix”

Magecart Hack Injects JavaScript to Steal Online Payment Data

Threat Actors Exploit LinkedIn for RAT Delivery in Enterprise Networks

Apache Airflow Flaws Expose Sensitive Workflow Data to Potential Attackers

OPNsense 25.7.11 Enhances Network Visibility With Host Discovery Feature

TP-Link Router Flaw Enables Authentication Bypass Through Password Recovery Mechanism

Discord Exploited to Spread Clipboard Hijacker Stealing Cryptocurrency Funds

Cloudflare Zero-Day Flaw Allows Attackers to Bypass Security and Access Any Host

Visual Studio Code Abused in Sophisticated Multistage Malware Attacks

Cybercriminals Impersonate Malwarebytes to Steal User Credentials

Attackers Rerouted Employee Pay Without Breaching IT Systems

PDFSIDER Malware Actively Exploited to Evade Antivirus and EDR Defenses

Argus: Python-Based Recon Toolkit Aims to Boost Security Intelligence

Researchers Hijack Hacker Domain Using Name Server Delegation

Threat Actors Abuse Browser Extensions to Deliver Fake Warning Messages

How Security Teams Use IP Location and DNS History In Cybercrime Investigation

Critical XSS Vulnerabilities in Meta Conversion API Enable Zero-Click Account Takeover

Best Security Awareness Training Platforms For 2026

Promptware Kill Chain – Five-Step Kill Chain Model For Analyzing Cyberthreats

GoLogin vs MultiLogin vs VMLogin – What’s the Anti-Detect Browsers Difference?

Spring CLI Vulnerability Allows Attackers to Execute Commands on User Systems

Multiple Elastic Vulnerabilities Could Lead to File Theft and DoS

PowerShell-Driven Multi-Stage Windows Malware Using Text Payloads