Do Son Microsoft Notepad now supports native Markdown table creation and editing. The update also brings streaming Copilot AI responses for faster writing and summarization.
Microsoft will fully retire the WINS name-resolution service after Windows Server 2025. Support for existing deployments ends in 2034, urging migration to DNS now.
Microsoft is testing a new preloading mechanism in Windows 11 Build 26220 to combat the notorious File Explorer lag and stutter, making app launch noticeably faster.
Apple will forgo major new features in iOS 27 and macOS 27 to focus on performance, bug fixes, and stability—a return to the foundational 'Snow Leopard' strategy.
X is rolling out "About this account," a new feature that publicly reveals an account's creation location and handle history to increase transparency and curb fake profiles.
Reports suggesting Tim Cook will step down as Apple CEO in early 2026 are "simply false," according to Mark Gurman. Cook is expected to remain until at least 2029.
The Google-DOJ ad-tech antitrust trial concluded closing arguments. Judge Brinkema seeks a swift ruling, though Google vows to appeal any order for divestiture.
NVIDIA patches two high-severity code injection flaws (CVE-2025-33183/4) in Isaac-GROOT, risking code execution & privilege escalation in robotics.
Acronis exposed TamperedChef, a global campaign using US shell companies to sign trojanized apps. The malware deploys a stealthy, obfuscated JavaScript backdoor via a scheduled task for long-term persistence.
A RCE flaw (CVE-2025-62164) in the vLLM inference engine allows attackers to crash servers or execute code by exploiting an out-of-bounds memory write via malicious prompt embeddings.
Google exposed APT24's stealth BADAUDIO C++ downloader. The three-year campaign includes a supply chain hack hitting 1,000+ domains, using control flow flattening and AES-encrypted cookies for C2.
Sophos exposed STAC3150, a campaign using fake "View Once" messages to deploy Astaroth banking trojan. The malware hijacks WhatsApp Web sessions via WPPConnect/Selenium for self-propagation.
CERT/CC warned that Tenda 4G03 Pro/N300 routers are exposed to an unpatched RCE flaw (CVE-2025-13207). Authenticated attackers can execute root-level commands via web requests due to insecure input handling.
Darktrace exposed Xillen Stealer v4/v5, a new MaaS threat using Rust polymorphism and an AIEvasionEngine to target 100+ browsers and Kubernetes/DevOps secrets. It uses steganography for exfiltration.
ABB patched a Critical (CVSS 9.6) Auth Bypass flaw (CVE-2025-10571) in Edgenius Management Portal. The bug allows unauthenticated remote attackers to install apps and execute arbitrary code. Update to v3.2.2.0.
Kaspersky exposed Tsundere, a Node.js botnet using an Ethereum smart contract for unkillable C2 updates. The system includes a cybercrime marketplace and spreads via fake MSI game installers for RCE.
A malicious PyPI typosquat (spellcheckers) infected 950+ users. The package deploys an XOR-encrypted Python RAT via a hidden index file, granting full remote execution (exec()) and is linked to crypto scams.
A Critical (CVSS 10.0) RCE flaw (CVE-2025-65108) in md-to-pdf allows arbitrary JavaScript code execution via malicious front-matter. Over 47K weekly downloads are affected. Update to v5.2.5.
Trustwave exposed Eternidade Stealer, a sophisticated Brazilian Trojan. The Python WhatsApp worm steals contact lists and uses IMAP email for covert C2 retrieval to launch banking overlays.
K7 Labs exposed a Python malware using multi-layer encoding (Base64/BZ2/Zlib) and a PNG-disguised RAR archive. The payload executes in memory and achieves stealth by injecting into cvtres.exe.
X is now letting Premium+ subscribers request dormant usernames, dividing them into 'Priority' and 'Rare' categories with ambiguous rules and rumored costs up to millions.
Google firmly denied misleading rumors that it changed its policy to use Gmail content for training Gemini AI models, stressing private data is not used for AI.