Do Son ISC warned of a High-severity DoS flaw (CVE-2025-11232) in Kea DHCPv4. A crafted DHCP packet can crash the server due to improper hostname validation, disrupting IP assignment. Patch to v3.0.2/3.1.3.
Urgent patch for WP Freeio plugin (v.< 1.2.22). Unauthenticated attackers can gain admin control instantly via a registration flaw. Update immediately to v.1.2.22.
Google Chrome 142 desktop update fixes 20 security flaws, including critical V8 Type Confusion (CVE-2025-12428) and Race conditions. Update your browser now.
Socket exposed an npm typosquat campaign using 10 fake packages (Netherеum.All). The malicious postinstall script deploys a 24MB PyInstaller stealer after prompting a fake CAPTCHA.
WSO2 patched three Critical flaws (CVSS 9.8) in API Manager/Identity Server. Flaws in regex access control and case-sensitive HTTP methods allow unauthenticated administrative takeover.
A critical hardware attack, TEE.fail, uses low-cost DDR5 memory bus interposition to extract root attestation keys from Intel TDX and AMD SEV-SNP. The flaw affects core server-grade TEEs.
ASEC exposed Trigona RaaS attacking exposed MS-SQL servers via brute-force. The group uses CLR Shell, a new Rust-based scanner, and the BCP utility to store and execute malware from database tables.
IIJ exposed a novel loader that simultaneously deploys TorNet (TOR C2) and PureHVNC (RAT) via DLL sideloading. It uses MurmurHash2 for API hashing and injects into jsc.exe for stealth.
A Babuk successor, Midnight ransomware, contains a critical flaw in its RSA key handling. Gen researchers created a free decryptor that bypasses the encryption, allowing victims to recover files.
HelixGuard exposed a VSCode supply chain attack using 12 malicious extensions. They steal source code, capture screenshots, and open reverse shells via Ngrok and AWS EC2 to compromise developers.
Google announced Chrome 154 (Oct 2026) will automatically enable “Always Use Secure Connections,” marking a major security push to combat MitM attacks by warning users before visiting unencrypted HTTP sites.
Researchers from Exodus Intelligence, led by Michele Campa, have disclosed a privilege-escalation vulnerability in Microsoft’s Cloud Files...
BitSight uncovered a Lampion banking Trojan campaign using ClickFix lures and a 700MB bloatware DLL to evade AV. The VBScript loader establishes persistence via the Windows Startup folder.
cybernewswire
Tel Aviv, Israel, 29th October 2025, CyberNewsWire
LiteSpeed Cache for WordPress (LSCWP) versions 7.5.0.1 are vulnerable to a Reflected XSS flaw, exposing 7M sites to account takeover. Update to 7.6 now.
A Critical Heap Overflow in strongSwan's EAP-MSCHAPv2 plugin allows Remote Code Execution on the client. An integer underflow in Failure Request packet processing causes memory corruption.
CISA added two critical DELMIA Apriso flaws (CVE-2025-6204/6205) to its KEV Catalog due to active exploitation. The flaws risk RCE and privileged access to manufacturing management systems.
IBM issued an urgent advisory for a Critical (CVSS 9.8) Auth Bypass flaw (CVE-2025-36386) in Maximo Manage. The flaw in MXCSP allows unauthenticated access to Cognos Analytics.
PayPal partnered with OpenAI to adopt the Agentic Commerce Protocol, allowing 400M users to securely purchase products directly within the ChatGPT interface by 2026.
MediaTek unveiled the Kompanio 540 chip for Chromebooks, featuring Arm Cortex-A78 cores and 35% better battery life, ideal for the education market.
The Windows 11 26H1 update is expected to be a Copilot+ PC exclusive for Qualcomm's Snapdragon X2
Adobe and Google partnered to integrate Premiere Mobile's professional tools directly into the YouTube Shorts workflow, adding AI features and exclusive templates.