Do Son AI demand caused a 2-year backlog for hard drives, forcing data centers to buy QLC SSDs. This shift threatens consumer SSD supply and drives up memory prices.
Wikipedia launches a paid API for AI companies to stop web scraping and generate revenue after sophisticated AI crawlers caused an 8% drop in human traffic.
Zimbra fixes Critical Stored XSS and an Unauthenticated LFI flaw, urging users to update immediately to mitigate session hijacking and data exfiltration risks.
SAP released its Patch Day update fixing 18 flaws, including two Critical (CVSS 10.0) vulnerabilities: RMI-P4 RCE and Hard-Coded Credentials in SQL Anywhere Monitor, risking unauthenticated takeover.
Critical Synology BeeStation Zero-Day (CVE-2025-12686) Found at Pwn2Own Allows Remote Code Execution
Critical Synology BeeStation Zero-Day (CVE-2025-12686) Found at Pwn2Own Allows Remote Code Execution
Synology patched a Critical (CVSS 9.8) RCE zero-day flaw (CVE-2025-12686) in BeeStation OS. The vulnerability, found during Pwn2Own, allows remote attackers to execute arbitrary code. Update to v1.3.2-65648.
Microsoft confirms Windows 11 26H1 (Build 28000), but it's not a feature update. It's a platform build exclusively for new ARM silicon like Snapdragon X2 and NVIDIA N1X.
Mozilla unveiled Kit, a new friendly fox mascot, to represent the Firefox brand's commitment to user privacy. It will appear across new tab pages and branding.
Microsoft is testing "Haptic Signals" in Windows 11 to give subtle vibrations for UI interactions like window snapping, targeting haptic-enabled mice and trackpads.
A fierce EU debate rages over the upper 6GHz spectrum. Mobile operators want it for 6G, while the Wi-Fi Alliance says it's essential for Wi-Fi 7 performance.
Mandiant exposed UNC6485 exploiting a Triofox zero-day (CVE-2025-12480). The critical flaw allows unauthenticated admin takeover by spoofing the HTTP Host header to bypass authentication checks.
SuiteCRM released an urgent patch (v8.9.1) for two SQL Injection flaws. The time-based SQLi (CVSS 8.8) and GraphQL SQLi allow authenticated users to extract sensitive customer data from the backend database.
Australia imposed sanctions and travel bans on four entities and one individual for engaging in cybercrime to fund North Korea's WMD and missile programs. The regime stole $1.9B in crypto in 2024.
CRIL exposed fileless phishing using malicious HTML attachments. Credentials are stolen via a fake Adobe login and instantly exfiltrated to Telegram bots, bypassing traditional domain filters.
Devolutions patched two flaws in Devolutions Server: A Critical (CVSS 9.4) Auth Bypass allows user impersonation via pre-MFA cookie replay, and another flaw leaks plaintext passwords to view-only users.
A Critical (CVSS 9.8) flaw (CVE-2025-59396) in WatchGuard Firebox allows unauthenticated remote root access via SSH on port 4118 using default credentials (admin:readwrite). Patch immediately.
GE Vernova patched a Critical Auth Bypass flaw (CVE-2025-3222) in Smallworld Master File Server. The flaw could allow users with system knowledge to circumvent authentication. Update immediately.
North Korea's KONNI APT is exploiting stolen Google accounts and the Find Hub service to remotely wipe South Korean Android devices for data destruction and surveillance, then spreading malware via KakaoTalk.
A Critical (CVSS 9.3) RCE flaw (CVE-2025-64486) in Calibre allows arbitrary code execution when a user views or converts a malicious FB2 e-book due to unsafe filename handling. Update to v8.14.0.
ENKI exposed a Lazarus Group espionage campaign targeting aerospace/defense firms. The new Comebacker variant uses malicious Word macros and ChaCha20/AES to deliver a memory-resident backdoor.
Acronis exposed DragonForce's evolution: the ransomware is compiled with MinGW, uses BYOVD drivers to terminate EDR, and contains fixes to prevent decryption of its Conti V3 derived codebase.
cybernewswire 
Fired Intel engineer Jinfeng Luo allegedly bypassed security to steal 18,000 confidential files before his final day. Intel is suing, but his whereabouts are unknown.