Do Son Mandiant exposed UNC6485 exploiting a Triofox zero-day (CVE-2025-12480). The critical flaw allows unauthenticated admin takeover by spoofing the HTTP Host header to bypass authentication checks.
SuiteCRM released an urgent patch (v8.9.1) for two SQL Injection flaws. The time-based SQLi (CVSS 8.8) and GraphQL SQLi allow authenticated users to extract sensitive customer data from the backend database.
Australia imposed sanctions and travel bans on four entities and one individual for engaging in cybercrime to fund North Korea's WMD and missile programs. The regime stole $1.9B in crypto in 2024.
CRIL exposed fileless phishing using malicious HTML attachments. Credentials are stolen via a fake Adobe login and instantly exfiltrated to Telegram bots, bypassing traditional domain filters.
Devolutions patched two flaws in Devolutions Server: A Critical (CVSS 9.4) Auth Bypass allows user impersonation via pre-MFA cookie replay, and another flaw leaks plaintext passwords to view-only users.
A Critical (CVSS 9.8) flaw (CVE-2025-59396) in WatchGuard Firebox allows unauthenticated remote root access via SSH on port 4118 using default credentials (admin:readwrite). Patch immediately.
GE Vernova patched a Critical Auth Bypass flaw (CVE-2025-3222) in Smallworld Master File Server. The flaw could allow users with system knowledge to circumvent authentication. Update immediately.
North Korea's KONNI APT is exploiting stolen Google accounts and the Find Hub service to remotely wipe South Korean Android devices for data destruction and surveillance, then spreading malware via KakaoTalk.
A Critical (CVSS 9.3) RCE flaw (CVE-2025-64486) in Calibre allows arbitrary code execution when a user views or converts a malicious FB2 e-book due to unsafe filename handling. Update to v8.14.0.
ENKI exposed a Lazarus Group espionage campaign targeting aerospace/defense firms. The new Comebacker variant uses malicious Word macros and ChaCha20/AES to deliver a memory-resident backdoor.
Acronis exposed DragonForce's evolution: the ransomware is compiled with MinGW, uses BYOVD drivers to terminate EDR, and contains fixes to prevent decryption of its Conti V3 derived codebase.
cybernewswire 
Fired Intel engineer Jinfeng Luo allegedly bypassed security to steal 18,000 confidential files before his final day. Intel is suing, but his whereabouts are unknown.
Microsoft revealed "Whisper Leak," a side-channel attack that infers AI chat topics from encrypted traffic (TLS) using packet size/timing patterns. High accuracy risk.
Apple's 2026 roadmap is huge: M6 Pro/Max MacBook Pros with OLED and touchscreen, a foldable iPhone, and a new AI-powered Health+ service.
Apple is expanding iPhone satellite features beyond SOS! New capabilities include off-grid Maps, photo messaging, 5G NTN support, and seamless "natural usage."
Unit 42 exposed LANDFALL, commercial-grade spyware that exploited a Samsung zero-day (CVE-2025-21042) in the image library libimagecodec.quram.so to compromise Galaxy phones via DNG images sent over WhatsApp.
Zimperium exposed Fantasy Hub, a Russian MaaS Android RAT. It uses a Telegram bot for subscriptions and WebRTC to covertly stream live video and audio, targeting Russian banks with dynamic overlays.
A NuGet supply chain attack injected time-delayed destructive logic into 9 packages. The malware triggers random crashes and silent data corruption on hardcoded future dates, targeting database/PLC applications.
GlassWorm resurfaced, infecting 3 new VS Code extensions on OpenVSX. The worm uses invisible Unicode and Solana blockchain C2 to steal credentials and spread via AI-generated malicious commits on GitHub.
A RCE flaw (CVE-2025-64439) in LangGraph's JsonPlusSerializer allows arbitrary Python code execution by exploiting a fallback during checkpoint deserialization. Update to v3.0.
Datadog exposed MUT-4831, a cluster that deployed Vidar Infostealer via 17 malicious npm packages. The malware uses postinstall scripts to download and execute the payload, stealing credentials and crypto wallets.