News Archives • Page 169 of 653 • Daily CyberSecurity

Critical Squid Proxy Flaw (CVE-2025-62168, CVSS 10.0) Leaks HTTP Credentials and Security Tokens via Error Handling Squid proxy vulnerabilities, buffer overflow attack Squid Credentials Leak, HTTP Authentication Redaction CVE-2024-25111

Squid proxy vulnerabilities, buffer overflow attack Squid Credentials Leak, HTTP Authentication Redaction CVE-2024-25111

Critical Squid Proxy Flaw (CVE-2025-62168, CVSS 10.0) Leaks HTTP Credentials and Security Tokens via Error Handling

Do Son October 20, 2025

The developers of Squid, the widely used open-source caching proxy for web traffic acceleration, have disclosed and...

shell-quote command injection AI-Driven Vulnerabilities Q1 2026 Cyber Threats vm2 Sandbox Escape Node.js RCE upKeeper Privilege Escalation CVE-2026-2449 Pharos Controls Vulnerability Root Access Exploit Cybersecurity Vulnerability Roundup CVSS 10.0 Flaws Shadow Archives CVE-2026-0866 MS-Agent Prompt Injection CVE-2026-2256 basic-ftp Path Traversal CVE-2026-27699 telnetd Root Vulnerability CVE-1999-0073 Regression USR-W610 Vulnerabilities End-of-Life IoT Security IceWarp Security Update IceWarp Vulnerabilities Airleader Master Vulnerability CVE-2026-1358 ZLAN5143D Vulnerability CISA ICS Advisory Acronis Cyber Protect Vulnerability CVE-2025-30411 WAGO 852 Vulnerability OT Network Security SandboxJS Vulnerability Sandbox Escape (CVSS 10.0) Kubernetes Local Path Provisioner CVE-2025-62878 CISA Unresponsive Vendors Avation & RISS Vulnerabilities KiloView Vulnerability CVE-2026-1453 OpenClaw RCE vulnerability Johnson Controls Vulnerability CVE-2025-26385 SandboxJS Vulnerability CVE-2026-23830 ibaPDA Vulnerability CVE-2025-14988 Protobuf Vulnerability CVE-2026-0994 AVEVA Process Optimization Vulnerability CVE-2025-61937 ConnectWise PSA Vulnerability CVE-2026-0695 Aruba VIA Vulnerability CVE-2025-37186 aiohttp v3.13.3, Denial of Service (DoS) SmarterMail RCE, CVE-2025-52691 Airoha RACE, Headphone Jacking HPE OneView RCE CVE-2025-37164 FreePBX Auth Bypass, PBX Takeover ScreenConnect Config Flaw, Untrusted Extensions Ruby SAML Auth Bypass, XML Parser Differential Devolutions SQL Injection, Password Manager Flaw Vivotek Unauthenticated RCE, EOL IP Camera Flaw Lynx+ Critical Flaw, Unauthenticated Reset Firebox Default Credentials, CVE-2025-59396 Veeder-Root RCE, Critical ATG Flaw ArcGIS Server SQLi Watchdoc RCE, CVE-2025-58384 Delta DIALink Daikin Security Gateway, authentication bypass Frostbyte10, industrial controller security SunPower, vulnerability Ubiquiti UniFi Connect, EV Station Vulnerabilities Adobe Experience Manager, RCE Vulnerability UniFi Access, Command Injection LDAPNightmare - CVE-2025-1316

GlassWorm Supply Chain Worm Uses Invisible Unicode and Solana Blockchain for Stealth C2

Do Son October 20, 2025

Cybersecurity researchers at Koi Security have discovered the world’s first self-propagating malware targeting VS Code extensions on...

SEQRITE Labs Uncovers “CAPI Backdoor” Campaign Targeting Russia’s Automobile and E-Commerce Sectors CAPI Banking Trojan, LNK Persistence

SEQRITE Labs Uncovers “CAPI Backdoor” Campaign Targeting Russia’s Automobile and E-Commerce Sectors

Do Son October 20, 2025

Researchers at SEQRITE Labs have uncovered a targeted spear-phishing campaign aimed at organizations in Russia’s automobile and...

UNC5142 Uses EtherHiding to Deploy Malware via BNB Smart Chain Smart Contracts UNC5142 EtherHiding, Resilient C2

UNC5142 Uses EtherHiding to Deploy Malware via BNB Smart Chain Smart Contracts

Do Son October 20, 2025

A new joint analysis by Mandiant Threat Defense and Google Threat Intelligence Group (GTIG) has exposed a...

131 Chrome Extensions Found Abusing WhatsApp Web for Spam Automation in Massive Reseller Scheme WhatsApp Spamware, Chrome Web Store Abuse

131 Chrome Extensions Found Abusing WhatsApp Web for Spam Automation in Massive Reseller Scheme

Do Son October 20, 2025

A new analysis from Socket has exposed a large-scale spamware operation abusing Google’s Chrome Web Store and...

FortiGuard Tracks HoldingHands Malware Shift: Cross-Regional APT Uses Task Scheduler Hijack to Evade Detection HoldingHands Rootkit, Cross-Regional APT

HoldingHands Rootkit, Cross-Regional APT

FortiGuard Tracks HoldingHands Malware Shift: Cross-Regional APT Uses Task Scheduler Hijack to Evade Detection

Do Son October 20, 2025

FortiGuard Labs has uncovered a sophisticated cross-regional campaign that has gradually expanded from China to Taiwan, Japan,...

North Korea’s WaterPlum APT Deploys Node.js OtterCandy RAT for Crypto Theft with Anti-Forensic Module North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korea’s WaterPlum APT Deploys Node.js OtterCandy RAT for Crypto Theft with Anti-Forensic Module

Do Son October 20, 2025

A new report from NTT Security Japan has spotlighted an evolved malware family known as OtterCandy, attributed...

Critical Moxa Flaw (CVE-2025-6950, CVSS 9.9) Allows Unauthenticated Admin Takeover via Hard-Coded JWT Secret Moxa Hard-Coded Credentials, Critical JWT Bypass CVE-2024-9137 and CVE-2024-9139 - CVE-2024-12297 CVE-2024-7695 CVE-2024-9404 CVE-2024-12297 CVE-2025-0415

Moxa Hard-Coded Credentials, Critical JWT Bypass CVE-2024-9137 and CVE-2024-9139 - CVE-2024-12297 CVE-2024-7695 CVE-2024-9404 CVE-2024-12297 CVE-2025-0415

Critical Moxa Flaw (CVE-2025-6950, CVSS 9.9) Allows Unauthenticated Admin Takeover via Hard-Coded JWT Secret

Do Son October 20, 2025

Moxa, a leading manufacturer of industrial networking and security appliances, has released an urgent security advisory addressing...

Researcher Details Zero-Click RCE in Dolby Audio Decoder Affecting Android, iOS, and macOS Dolby Zero-Click RCE, Audio Decoder Overflow

Researcher Details Zero-Click RCE in Dolby Audio Decoder Affecting Android, iOS, and macOS

Do Son October 20, 2025

Researchers Ivan Fratric and Natalie Silvanovich from Google Project Zero have disclosed a critical 0-click vulnerability (CVE-2025-54957,...

North Korea’s UNC5342 APT Uses EtherHiding to Store Malware in Blockchain Smart Contracts for Stealthy C2 North Korea EtherHiding, Blockchain C2

North Korea’s UNC5342 APT Uses EtherHiding to Store Malware in Blockchain Smart Contracts for Stealthy C2

Do Son October 20, 2025

Google Threat Intelligence Group (GTIG) has uncovered a new campaign by the North Korean threat actor UNC5342,...

Google Abandons Privacy Sandbox Initiative After 6 Years, Citing Low Adoption of New Ad Tech

Do Son October 20, 2025

Google recently announced through its official Privacy Sandbox website that the ambitious initiative—launched in 2019 to replace...

NVIDIA Unveils First Blackwell Wafer Made in US at TSMC Arizona Fab, Marking Production Milestone Apple NVIDIA TSMC Semiconductor Supply War NVIDIA Blackwell Wafer, TSMC Arizona Fab

Apple NVIDIA TSMC Semiconductor Supply War NVIDIA Blackwell Wafer, TSMC Arizona Fab

NVIDIA Unveils First Blackwell Wafer Made in US at TSMC Arizona Fab, Marking Production Milestone

Do Son October 20, 2025

NVIDIA recently announced a milestone of profound symbolic significance, as CEO Jensen Huang personally unveiled the first...

Apple Secures Exclusive F1 Broadcasting Rights in the US Starting 2026; F1 TV Pro Included with Apple TV Apple TV F1 Exclusive, F1 TV Pro Included

Apple Secures Exclusive F1 Broadcasting Rights in the US Starting 2026; F1 TV Pro Included with Apple TV

Do Son October 20, 2025

Apple has announced a landmark five-year exclusive broadcasting agreement with Formula 1’s parent company, Liberty Media, granting...

Critical Keras 3 RCE Flaw (CVE-2025-49655, CVSS 9.8) Allows Code Execution on Model Load Keras RCE, Insecure Deserialization

Critical Keras 3 RCE Flaw (CVE-2025-49655, CVSS 9.8) Allows Code Execution on Model Load

Do Son October 20, 2025

Researchers at HiddenLayer have disclosed a critical arbitrary code execution vulnerability in the Keras 3 deep learning...

Wikipedia Warns of Existential AI Threat as Page Views Fall 8% Due to Chatbot Summaries Yoshua Bengio AI sycophancy, reverse deception AI feedback AI chatbots, FTC investigation AI-generated content Trump AI Policy, AI Deregulation Military AI, DoD Funding Stargate Project AI Art Restoration

Yoshua Bengio AI sycophancy, reverse deception AI feedback AI chatbots, FTC investigation AI-generated content Trump AI Policy, AI Deregulation Military AI, DoD Funding Stargate Project AI Art Restoration

Wikipedia Warns of Existential AI Threat as Page Views Fall 8% Due to Chatbot Summaries

Do Son October 20, 2025

The Wikimedia Foundation has issued a stark warning, cautioning that the rapid rise of artificial intelligence poses...

Privilege Escalation Flaw Discovered in MinIO Service Accounts — CVE-2025-62506 MinIO Signature Bypass Unauthenticated Object Write MinIO Privilege Escalation, Policy Bypass CVE-2024-55949

MinIO Signature Bypass Unauthenticated Object Write MinIO Privilege Escalation, Policy Bypass CVE-2024-55949

Privilege Escalation Flaw Discovered in MinIO Service Accounts — CVE-2025-62506

Do Son October 18, 2025

The developers of MinIO, a popular high-performance, S3-compatible object storage platform, have issued a critical security advisory...

Google DeepMind Partners with CFS to Use AI for Optimizing SPARC Fusion Reactor Efficiency DeepMind Fusion AI, SPARC Optimization

Google DeepMind Partners with CFS to Use AI for Optimizing SPARC Fusion Reactor Efficiency

Do Son October 17, 2025

Google DeepMind has announced a partnership with U.S.-based nuclear fusion startup Commonwealth Fusion Systems (CFS) to leverage...

Zimbra Issues Emergency Patch for Critical SSRF Vulnerability in Chat Proxy Configuration Zimbra SSRF, Chat Proxy Flaw

Zimbra Issues Emergency Patch for Critical SSRF Vulnerability in Chat Proxy Configuration

Do Son October 17, 2025

Zimbra has released an emergency security patch (version 10.1.12) to address a critical Server-Side Request Forgery (SSRF)...

Record $40 Billion Deal: NVIDIA, Microsoft, BlackRock Consortium Acquires Aligned Data Centers AI Infrastructure Deal, Aligned Data Centers Abilene data center

AI Infrastructure Deal, Aligned Data Centers Abilene data center

Record $40 Billion Deal: NVIDIA, Microsoft, BlackRock Consortium Acquires Aligned Data Centers

Do Son October 17, 2025

The AI Infrastructure Partnership (AIP)—an investment consortium comprising technology giants such as NVIDIA, Microsoft, xAI, and Cisco—has...

Apple Planning Touchscreen OLED MacBook Pro with M6 Chip for Late 2026 Debut MacBook Pro OLED touch screen MacBook Pro Touchscreen, M6 Chip OLED M5 MacBook Pro, 24-Hour Battery

MacBook Pro OLED touch screen MacBook Pro Touchscreen, M6 Chip OLED M5 MacBook Pro, 24-Hour Battery

Apple Planning Touchscreen OLED MacBook Pro with M6 Chip for Late 2026 Debut

Do Son October 17, 2025

According to recent reports, Apple appears poised to break from long-standing tradition by introducing touchscreen functionality to...

Critical Alert 1 Active Exploit Detected Today