Do Son Roundcube patches two High-severity flaws: an SVG-based XSS and a CSS sanitizer bypass. Protect your inbox—update to v1.6.12 or v1.5.12 now.
Check Point Research exposes the YouTube Ghost Network, using GachiLoader to spread Rhadamanthys infostealer through cracked software and game cheats.
ReversingLabs uncovered Nethereum.All, a malicious NuGet package with 10M+ fake downloads designed to drain crypto wallets and steal API secrets.
A critical UEFI flaw in ASRock, ASUS, and MSI motherboards fails to enable IOMMU, allowing pre-boot memory access via PCIe devices.
Jolly Scorpius has upgraded its Mario ransomware with multi-layered, dual-key encryption and dynamic chunking to bypass recovery and lock down data.
Phantom v3.5 info-stealer targets passwords and crypto via a fake Adobe installer. It uses SMTP to exfiltrate data directly to attackers.
Starting in 2029, the Oscars move exclusively to YouTube, ending a 50-year run on ABC to reach a global, digital-first audience.
Security firm KOI warns: Urban VPN extensions are secretly harvesting full AI chat transcripts for data brokers. Uninstall immediately to protect your data.
Google’s Gemini 3 Flash defies logic: an ultra-efficient model scoring 81.2% on MMMU-Pro, outperforming OpenAI’s flagship GPT-5.2 in multimodal reasoning.
cybernewswire
Cary, North Carolina, USA, 18th December 2025, CyberNewsWire
The continued expansion of digital finance has brought renewed attention to how cryptocurrency systems intersect with access...
GitHub walks back its plan to charge $0.002/min for self-hosted runners, postponing the fee indefinitely following intense backlash from the community.
HPE issued an urgent alert for a CVSS 10.0 RCE in OneView. Attackers can seize unauthenticated control of data centers. Upgrade to v11.00+ now.
CISA adds a CVSS 10 Cisco zero-day and SonicWall exploit chains to its KEV catalog, warning of active exploitation by Chinese APTs and supply chain attacks.
Cisco warns of a CVSS 10 zero-day (CVE-2025-20393) exploited by Chinese APT UAT-9686 to backdoor Secure Email Gateways with the Aqua malware suite.
SonicWall warns of zero-day attacks chaining CVE-2025-40602 and CVE-2025-23006 to gain unauthenticated root access on SMA1000 appliances. Patch now!
The Forum Troll APT is targeting Russian scholars with highly personalized phishing lures and the Tuoni framework disguised as plagiarism reports.
Hackers are weaponizing AWS termination protection to lock defenders out while they mine crypto on hijacked ECS/EC2 resources using a malicious Docker image.
A Russian APT is targeting Transnistria and NATO entities using blurred HTML attachments to harvest credentials. The 2025 campaign mimics official presidential decrees.
A normalization flaw in Better Auth's router allows attackers to bypass access controls and rate limits using simple double-slash URLs.
Ink Dragon is weaponizing government servers in Europe using a relay-centric mesh. By hijacking IIS servers, they mask C2 traffic across global networks.
A critical RCE flaw (CVSS 9.8) in Apache Commons Text mirrors Log4Shell, allowing server takeover. FileMaker Server users must update to v22.0.4 now.