Do Son Mark Gurman says the iPhone Air 2 is cancelled, confirming Apple will shift to a split release cycle: high-end/Fold in Fall 2026, followed by standard models in Spring 2027.
pgAdmin patched four flaws. The Critical RCE (CVE-2025-12762) risks arbitrary code execution via malicious PostgreSQL dump files. LDAP Injection (CVE-2025-12764) and TLS Bypass were also fixed. Update to v9.10.
A High-severity flaw (CVE-2024-21635) in Memos fails to invalidate Access Tokens upon password change, allowing attackers to maintain access to the knowledge base. Update to v0.25.2.
Cisco Talos reports Kraken, a HelloKitty successor, is a cross-platform RaaS targeting Windows/ESXi. The malware uniquely benchmarks CPU/IO to optimize encryption speed and uses Cloudflared/SSHFS for persistence.
IBM patched four critical flaws in AIX/VIOS. The RCE (CVSS 10.0) in nimesis and CVE-2025-36096 allow remote attackers to execute commands and obtain NIM private keys. Update immediately.
NVISO exposed the Contagious Interview APT using JSON Keeper and npoint.io as covert C2 channels. The North Korean group uses fake job lures on GitLab to deploy BeaverTail to steal Web3 credentials.
AWS Inspector exposed the largest npm supply chain incident ever: 150,000+ malicious packages were uploaded in a coordinated campaign to exploit tea.xyz token rewards via tea.yaml files.
CISA warned of four flaws in Lynx+ Gateway. The Critical (CVSS 10.0) Auth Bypass allows unauthenticated remote reset and cleartext credential theft. Vendor GIC has not responded to CISA.
Despite a recent doxxing attempt, Lumma Stealer has resurfaced, integrating browser fingerprinting into its C&C to collect WebGL/Canvas signatures for sandbox evasion and victim assessment.
Group-IB exposed an automated PhaaS kit that impersonates Aruba S.p.A. to steal credentials, credit card details, and OTPs. The multi-stage scam uses a CAPTCHA filter and Telegram for real-time exfiltration.
ASEC exposed Yurei, a new Go-based ransomware group using ChaCha20-Poly1305/ECIES for irreversible encryption. The stealthy RaaS operates with minimal initial setup and focuses on double extortion.
Sam Altman confirmed ChatGPT has fixed its overuse of the em dash. The model will now respect Custom Instructions to stop using the punctuation, removing a clear AI tell.
X (Twitter) launched 'Chat' to replace DMs, adding video/voice calling, file sharing, editing, and E2E encryption for messages on iOS and web. Android is coming soon.
Google announced a $40B investment in Texas by 2027 to build new cloud and AI data centers. The plan includes a $30M Energy Impact Fund and workforce training.
Microsoft publicly released the Xbox Game Publishing Guide, previously partner-only, to remove barriers and make it easier for all developers to launch titles on Xbox and PC.
Meta confirmed WhatsApp is ready for DMA interoperability with third-party apps BirdyChat and Haiket. European users can soon opt in to cross-platform chats.
Amazon officially rebranded its LEO satellite initiative, formerly Project Kuiper, as Amazon Leo, signaling its readiness to transition the network into a commercial product.
Sender Policy Framework (SPF) is a vital component of modern email authentication protocols, designed to combat email...
Symfony patched a High-severity flaw (CVE-2025-64500) in its Request component. Improper PATH_INFO parsing allows attackers to bypass access control rules in vulnerable applications.
Cisco patched a High-severity EoP flaw (CVE-2025-20341) in Catalyst Center Virtual Appliance. A low-privileged Observer user can remotely elevate privileges to Administrator via a crafted HTTP request.
Apple launched the Mini Apps Partner Program, cutting the App Store commission fee in half—from 30% to 15%—for eligible developers of self-contained web-based services.
“Is it working?” It can be easy to drop an AI SOC agent into your environment and...