Do Son A Critical (CVSS 9.8) flaw (CVE-2025-8489) in King Addons for Elementor is actively exploited. The bug allows unauthenticated attackers to register as administrators by injecting user_role. 48,400+ attacks blocked.
A High-severity XSS flaw (CVE-2025-66412, CVSS 8.5) in Angular allows attackers to bypass sanitization and execute scripts via vulnerable SVG/MathML attributes. Update to v21.0.2 immediately.
A critical vulnerability in the abandoned lz4-java library exposes apps to DoS. Discover the fix and the mandatory fork migration path here.
cybernewswire
Bethesda, USA / Maryland, 2nd December 2025, CyberNewsWire
Apple's AI chief John Giannandrea is stepping down. Amid lagging progress, Apple hired former Google Gemini exec Amar Subramanya to spearhead its foundational AI strategy.
E-commerce giant Coupang confirmed a breach exposing 33.7 million users (names, emails, addresses)—nearly its entire base. Financial data was not compromised, but social engineering risk is high.
Europol dismantled the centralized mixer CryptoMixer, which laundered over €1.3B in Bitcoin since 2016. Authorities seized three servers and confiscated more than €25M in digital assets.
AWS Transform launched Agentic AI capabilities to automate legacy code modernization across .NET, VMware, and mainframes. It reduces technical debt 5x faster than manual work.
AWS unveiled Agentic AI for Connect, the Marengo 3.0 video model on Bedrock, a Visa payments partnership, and S&P Global data integration at re:Invent 2025.
NVIDIA announced a $2B equity investment in Synopsys to expand their partnership, integrating Agentic AI and accelerated computing into chip design, automotive, and aerospace engineering.
AWS unveiled Nova Sonic-powered Agentic AI for Connect, capable of human-like reasoning and task execution. AWS also partnered with Google Cloud to simplify multi-cloud networking.
India mandates the preinstallation of the Sanchar Saathi cybercrime app on all new smartphones. The app is non-removable, raising major privacy concerns for Android and Apple users.
A malware technique that literally turns its victim into unwitting accomplices: that’s ClickFix. In 2025, it boosted...
OpenVPN released an urgent patch (v2.7_rc2) fixing two critical flaws: a Heap Over-read (CVE-2025-12106, CVSS 9.1) and an HMAC bypass (CVE-2025-13086) that allows unauthenticated DoS. Windows 7 support is broken.
Google’s December update fixes a Critical DoS flaw (CVE-2025-48631) and two actively exploited zero-days (Info Disclosure/EoP). Kernel (PKVM) and Framework components are at high risk. Update to 2025-12-05 immediately.
A Critical flaw (CVE-2025-11699) in nopCommerce allows attackers to hijack admin accounts by reusing session cookies that fail to invalidate upon logout. Update to v4.90.3 immediately.
G DATA exposed Arkanix, a fast-evolving C++ stealer. Its premium version uses process injection and Chrome Elevator to bypass Chrome App-Bound Encryption (ABE) and steal crypto wallets and Wi-Fi passwords.
Apache patched a Critical DoS flaw (CVE-2025-64775) in Struts. The bug causes a temporary file leak during multipart requests, allowing unauthenticated attackers to fill the disk and crash the server. Update now.
Transparent Tribe (APT36) evolves with new Linux malware targeting Indian government BOSS systems via weaponized shortcut files.
Meet Albiriox, a new Russian Android banking Trojan sold as a service. Learn how its "AcVNC" tech enables on-device fraud against 400+ global apps.