Do Son Volexity exposed Russian APT UTA0355 using fake security conference sites and WhatsApp support to trick victims. The attacks steal Microsoft 365 OAuth and Device Code tokens for persistent access.
A Rust supply chain attack used typosquatting (finch-rust) and an unpinned dependency to silently update the sha-rust payload over two weeks, stealing credentials and private keys from developers.
CISA/NSA exposed BRICKSTORM, a Chinese state-sponsored backdoor targeting VMware vCenter/ESXi and ADFS servers. The self-restarting malware used DoH and nested TLS for 18 months of persistent espionage.
A High-severity flaw (CVE-2025-66566) in lz4-java allows remote attackers to read uninitialized memory (passwords/keys) from recycled buffers during decompression. Update to v1.10.1 immediately.
A Critical (CVSS 9.9) Auth Bypass flaw (CVE-2025-66489) in Cal.com allows attackers to bypass password checks and hijack accounts by supplying any value in the TOTP field. Update to v5.9.8.
WatchGuard patched five flaws in Fireware OS. CVE-2025-11838 (CVSS 8.7) allows unauthenticated VPN DoS, while CLI Command Injection risks RCE in the management interface. Update immediately to v2025.1.3.
FortiGuard exposed UDPGangster, a custom UDP backdoor deployed by MuddyWater APT. The malware evades network defenses and analysis by using UDP for C2 and checking for single-core CPUs/low RAM.
Google exposed Intellexa (Predator spyware vendor) using 15 zero-days since 2021, including the iOS "smack" exploit chain (JSKit). Google is issuing mass warnings to targeted users globally.
A Critical DoS flaw (CVE-2025-66418) in urllib3 allows malicious servers to crash client apps via an unbounded decompression chain. A streaming flaw also risks memory exhaustion. Update to v2.6.0.
A new ValleyRAT campaign targets English job seekers. The malware uses DLL sideloading via a trojanized Foxit PDF Reader executable to run a Remote Access Trojan and exfiltrate data.
GreyNoise detected a coordinated mass scanning campaign where 7,000+ IPs (from 3xK GmbH) probed Palo Alto GlobalProtect portals and SonicWall SonicOS API endpoints using identical client fingerprints.
As we move further into the digital age, the importance of robust cybersecurity measures has never been...
A Catastrophic (CVSS 10.0) Auth Bypass flaw (CVE-2025-44005) in Step CA's ACME/SCEP provisioners allows unauthenticated attackers to issue fraudulent certificates and access restricted infrastructure. Update to v0.29.0.
China-linked APT UNC5174 is using a Go-based backdoor that abuses the Discord API as a covert C2 channel. This method allows the lightweight malware to execute arbitrary commands and evade traditional firewall monitoring.
cybernewswire
Madison, United States, 5th December 2025, CyberNewsWire
Torrance, California, USA, 5th December 2025, CyberNewsWire
OpenAI is testing a "Confession" mechanism to reduce hallucinations. Models are trained to disclose internal flaws and lies, rewarding them for candor over accuracy.
Google expanded Android's call-scam protection. It detects suspicious calls while financial apps are open, triggering a 30-second mandatory pause for users.
Russia imposed a network-level blockade on Apple's encrypted FaceTime service, citing its alleged use for coordinating fraud and terrorist attacks, making the app unusable.
Apache HTTP Server 2.4.66 patched five flaws. Key fixes include a moderate SSRF flaw (CVE-2025-59775) that risks NTLM hash leakage on Windows, and a mod_userdir/suexec bypass. Update immediately.
ASEC exposed PrintMiner, a Monero cryptominer spreading via USB LNK files. It uses DLL Side-Loading (printui.exe) and "Smart Mining" to suspend activity when games or Task Manager are opened.
Apache patched a Catastrophic XXE flaw (CVE-2025-66516, CVSS 10.0) in Tika Core. The bug is exploitable via malicious XFA data inside a PDF, risking server-side data disclosure and RCE. Update immediately.