Do Son Amazon exposed Chinese APTs exploiting the React2Shell zero-day (CVE-2025-55182, CVSS 10.0) hours after disclosure. Earth Lamia and Jackpot Panda are actively targeting unpatched Next.js servers for reconnaissance.
SEQRITE exposed Operation DUPEHIKE targeting Russian HR with a malicious LNK bonus lure. The DUPERUNNER implant uses PowerShell and process injection into explorer.exe to deploy the Adaptix C2 Beacon.
A High-severity flaw (CVSS 8.0) in Splunk Enterprise/Universal Forwarder for Windows allows low-privileged users to access/tamper with sensitive installation directories due to incorrect permissions. Update to v10.0.2+.
A High-severity RCE flaw (CVE-2025-66399) in Cacti allows authenticated attackers to execute commands by injecting newline characters into the SNMP Community String. Update to v1.2.29 immediately.
Sekoia exposed Russian Calisto APT (FSB-linked) targeting RSF and NGOs with spear-phishing. The attack uses a custom AiTM kit and a "missing file" lure to steal credentials and 2FA codes.
NVIDIA patched two high-severity DoS flaws in Triton Inference Server (CVE-2025-33211, CVE-2025-33201). Attackers can crash the server by sending malformed or excessively large payloads. Update to r25.10 immediately.
Patchwork APT deployed StreamSpy, a new trojan that uses WebSocket for covert C2 and HTTP for file transfer, blending malicious activity with web traffic to evade detection during espionage operations.
Microsoft reportedly slashed enterprise AI sales quotas by up to 50% after teams struggled to meet targets for platforms like Azure and Microsoft Foundry.
Telegram is developing passkey authentication to replace unreliable SMS codes. The move promises a far more secure login, leveraging biometrics (Face ID/fingerprint).
cybernewswire 
India reversed its mandate to pre-install the Sanchar Saathi app, claiming "voluntary adoption" but following strong resistance from Apple, Samsung, and political opposition.
AWS CEO Andy Jassy confirms Trainium AI chip revenue hit multi-billions. Over 1M units power 100K enterprises, driven by superior price-performance over GPUs.
Meta hired Alan Dye, former Apple VP of Human Interface Design (Apple Watch, Vision Pro), to lead a new Creative Studio focused on fusing AI, fashion, and hardware design.
Google is testing AI-rewritten headlines in Discover, which often distort original content (e.g., Steam Machine price) and risk misleading users about news facts.
Developers using the modern stack of Next.js and React are facing a “red alert” situation today. A...
A Critical RCE flaw (CVE-2025-6389) in Sneeit Framework is under active exploitation. The bug allows unauthenticated attackers to run arbitrary PHP code via call\_user\_func(). 131K+ attacks blocked.
The React Team patched a Catastrophic RCE flaw (CVE-2025-55182, CVSS 10.0) in Server Components. Unauthenticated attackers can execute arbitrary code via a deserialization bug. Immediate upgrade is mandatory.
Koi Security exposed ShadyPanda, which infected 4.3M+ users by weaponizing trusted browser extensions (WeTab, Clean Master) through auto-updates. The malware performs RCE and exfiltrates data to China.
Zscaler exposed Matanbuchus v3.0, a MaaS downloader pivoting to ransomware. The stealthy C++ malware uses Protobufs for C2, QuickAssist for access, and time-wasting loops to bypass sandboxes.
A 3-flaw chain (CRLF, Auth Bypass, SQLi) achieves root RCE on Synology BeeStation. The exploit uses a "Dirty File Write" SQLi to inject a malicious crontab entry, bypassing the lack of a PHP interpreter.
Water Saci Campaign Uses LLMs to Convert Malware to Python, Spreads Banking Trojan Via WhatsApp Worm
Water Saci Campaign Uses LLMs to Convert Malware to Python, Spreads Banking Trojan Via WhatsApp Worm
Trend Micro exposed Water Saci, a campaign using LLMs to convert malware from PowerShell to Python, accelerating its spread via a WhatsApp worm. The multi-stage attack deploys a trojan capable of VNC mirroring and overlay attacks.
A High-severity Vim for Windows flaw (CVE-2025-66476) allows arbitrary code execution. The editor executes malicious binaries in the current working directory instead of safe system paths when running commands like :grep.