Do Son NIST warns of a critical Exim 4.99 flaw. A failed SQLi patch allows attackers to poison SQLite records and trigger a 1.5MB heap buffer overflow.
Do Son
Do Son is the Founder and Editor of Daily CyberSecurity. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.
Sophos CTU reveals how the ClickFix tactic led to a Qilin ransomware attack via NetSupport RAT and StealC V2 using stolen VPN credentials.
Gen Digital uncovers AuraStealer, a new infostealer using TikTok "Scam-Yourself" tactics to trick users into infecting their own Windows PCs.
RSF uncovers ResidentBat, a Belarusian KGB spyware physically installed during interrogations to hijack encrypted messages and monitor journalists.
A joint Hunt.io and Acronis report exposes the shared infrastructure behind Lazarus and Kimsuky, revealing the unified web of North Korean hacking.
Apache NiFi patches a High-severity flaw (CVE-2025-66524) in the GetAsanaObject processor. Unfiltered deserialization risks system compromise. Update now!
Kimsuky is deploying a new DOCSWAP RAT via QR codes and smishing. The DPRK-linked malware turns phones into surveillance tools for data theft.
A notorious cyber-espionage group known for terrorizing South American institutions has launched a new campaign against the...
BlueDelta (APT28) is targeting UKR.NET users with a sophisticated phishing campaign using ngrok and Mocky to bypass security and steal 2FA codes.
A High-severity flaw (CVE-2025-63387) in Dify v1.9.1 allows unauthenticated users to access sensitive system configurations via an unprotected API.
A maximum-severity HPE OneView flaw (CVE-2025-37164) bypasses auth to execute code via the ID Pools API. Upgrade to v11.00 or apply hotfixes now.
Meta "pauses" its Horizon OS partnership with ASUS and Lenovo, refocusing Reality Labs budgets on AI-powered smart glasses and first-party Quest hardware.
With 1.8 million infected Android TVs, Kimwolf issued 1.7 billion commands in 3 days, using Ethereum ENS to become a nearly un-killable cyber threat.
Microsoft’s new native NVMe I/O for Windows Server 2025 bypasses legacy SCSI paths, boosting IOPS by 70% while slashing CPU usage by 45%.
Amazon foils 1,800+ North Korean hacks, using a 110ms keystroke lag to expose a fake sysadmin operating from an Arizona "laptop farm."
Meta is testing a two-link monthly limit for unverified Facebook professional accounts, forcing creators to pay $14.99/mo to share external content.
OpenAI’s new App Directory lets ChatGPT summarize Dropbox files, order DoorDash, and manage Music directly, turning the AI into a true digital gateway.
Trump Media merges with Google-backed TAE Technologies in a $6B deal to build a 50MW fusion plant by 2026, targeting the AI energy boom.
FIFA reveals its first post-EA football game, launching exclusively on Netflix Games in 2026 with smartphone-based controls and a fresh, casual approach.
TikTok CEO Shou Zi Chew confirms a final deal to sell U.S. operations to an Oracle-led venture by January 22, 2026, ending the threat of a nationwide ban.
Linux logs its first Rust CVE (CVE-2025-68260): a race condition in the Android Binder driver causing kernel crashes. Fixed in 6.18.1 and 6.19-rc1.
Elastic patches a High-severity XSS flaw (CVE-2025-68385) in Kibana. Attackers can weaponize Vega visualizations to hijack sessions. Update now!