Do Son CVE-2025-68428 reveals a 9.2 critical flaw in jsPDF's Node.js build, allowing arbitrary file reads from servers. Upgrade to version 4.0.0 now!
Do Son
Do Son is the Founder and Editor of Daily CyberSecurity. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.
aiohttp 3.13.3 patches 7 flaws including memory exhaustion (CVE-2025-69228) and infinite loops (CVE-2025-69227). Update your Python servers now!
Apache SIS patches a decade-old XXE flaw (CVE-2025-68280) that allows attackers to steal server files via malicious map data. Update to version 1.6!
Apache Kyuubi patches a high-severity 8.8 CVSS flaw (CVE-2025-66518) that allows unauthorized local file access via path traversal. Update to v1.10.3!
Adobe patches a critical ColdFusion flaw (CVE-2025-61808) that uses remote SMB shares and CAR files to bypass security and achieve total server takeover.
MediaTek's Jan 2026 bulletin reveals critical modem flaws and memory corruption risks across dozens of chipsets. Update your device to stay safe!
GlassWorm Wave 4 targets macOS developers via VS Code, using encrypted payloads and a 15-minute fuse to trojanize Ledger and Trezor wallet apps.
D4mianWayne details CVE-2025-68615, a 9.8 critical flaw in Net-SNMP allowing unauthenticated RCE. Update to v5.9.5 or v5.10.pre2 now!
Researcher Mickey Jin uncovers CVE-2025-43530, a critical TCC bypass in macOS allowing attackers to hijack user data via accessibility tools.
Microsoft confirms Windows 11 SE support ends Oct 2026, leaving schools with underpowered hardware and a forced choice: upgrade or switch to Google.
Riot Games suffers a global League of Legends login outage after a digital certificate expired on Jan 4, 2026—echoing a similar lapse from 2016.
A zero-day in Quake III Arena engines (ioquake3, OpenArena) allows attackers to read sensitive system files and target players. Check RCON access now!
OpenAI is reportedly planning to acquire Pinterest for $17.5B in 2026. The goal? High-quality visual data and a proven ad engine to take on Google.
Satya Nadella’s 2026 AI manifesto calls for a shift from "models to systems," but the #Microslop backlash proves users are tired of AI-generated junk.
A massive leak of PS5 BootROM keys has exposed Sony’s hardware trust root. This unpatchable flaw clears the path for permanent jailbreaks and custom firmware.
Bitfinex hacker Ilya Lichtenstein released early in Jan 2026! He credits Trump’s First Step Act and vows a new career in cybersecurity research.
Telegram's first 2026 update adds AI channel summaries powered by the private Cocoon network and a gorgeous Liquid Glass redesign for iOS.
CVE-2026-21440: A critical 9.2 flaw in AdonisJS file uploads allows attackers to overwrite system files and gain RCE. Update to v10.1.2 immediately!
Threat actor uses React2Shell to deploy Sliver C2 on FortiWeb devices, using a Bangladesh Airforce decoy to target govt and financial sectors.
Unit 42 unmasks VVS Stealer, a Python-based threat using Pyarmor obfuscation to bypass AV, hijack Discord sessions, and steal browser credentials.
JD Cloud alerts users to CVE-2025-66848, a 9.8 critical flaw allowing remote attackers to bypass auth and gain root access on NAS routers.
CYFIRMA unmasks APT36's latest campaign: a fake JLPT exam lure using fileless LNK malware to evade antivirus and spy on Indian government targets.