Do Son Google issued an urgent Stable Channel update for Chrome (v141.0.7390.122) to fix a High-severity V8 flaw (CVE-2025-12036) that could lead to Remote Code Execution via a malicious web page.
Google exposed pro-Russia IO campaigns (Portal Kombat, Doppelganger) exploiting a Polish drone incursion to deflect blame from Russia, undermine NATO, and discredit the Polish government.
Sauter patched six flaws in modulo 6 devices. The Critical CVE-2025-41723 (CVSS 9.8) flaw allows unauthenticated file upload via the SOAP interface, risking RCE. Update to v3.2.0.
Kaspersky exposed the resurfaced PassiveNeuron campaign targeting Asia via MS SQL servers. The APT deploys custom Neursite and NeuralExecutor backdoors using Phantom DLL Hijacking for stealth persistence.
Unit 42 exposed Scattered LAPSUS$ Hunters pivoting to Extortion-as-a-Service (EaaS) after Salesforce leaks. The group is recruiting insiders and teasing SHINYSP1D3R ransomware on Telegram.
ABB disclosed a Critical (CVSS 9.9) Missing Auth flaw (CVE-2025-9574) in EoL ALS-mini-S4/S8 load controllers, allowing unauthenticated remote config access. No patch will be released.
Qianxin exposed Bitter APT using a WinRAR path traversal flaw and malicious Office macros to deploy a C# backdoor against military/FinTech targets in Asia. The attack sets up scheduled persistence.
Google exposed Russia's COLDRIVER APT deploying a new "ROBOT" malware family (NOROBOT, YESROBOT) just 5 days after its LOSTKEYS tool was disclosed. The multi-stage malware uses a ClickFix lure.
A Windows Agere Modem EoP flaw (CVE-2025-24990) under active exploit allowed arbitrary kernel R/W even when unused. Microsoft removed the driver in the October update. PoC is available.
WSO2 patched two Critical flaws: CVE-2025-10611 (CVSS 9.8) allows unauthenticated admin bypass of System REST APIs, and CVE-2025-9804 (CVSS 9.6) allows privilege escalation via SOAP services.
cybernewswire
Wilmington, Delaware, 21st October 2025, CyberNewsWire
Computers are essential tools in both personal and professional life, handling everything from work and communication to...
Figma CEO Dylan Field says AI isn't a job threat; a company survey shows 60% of professionals are shifting to higher-value work thanks to AI.
OpenAI launches "ChatGPT Login" allowing users to pay third-party service API costs using their query quota, creating a new AI-centered ecosystem.
A Critical RCE flaw (CVE-2025-61932, CVSS 9.8) in Lanscope Endpoint Manager (v9.4.7.1 and earlier) is actively exploited via malicious packets.
TP-Link patched four critical RCE/command injection flaws in its Omada gateways. CVE-2025-6542 (CVSS 9.3) allows unauthenticated remote OS command execution. Update firmware immediately.
iOS 26.1 Beta 4 introduces a new setting to disable the lock screen swipe-to-open Camera gesture, preventing accidental launches and battery drain.
Microsoft has patched a critical 9.9/10 ASP.NET Core Kestrel vulnerability (CVE-2025-55315) that allows unauthenticated HTTP request smuggling.
Microsoft released emergency update KB5070773 to fix a critical bug where USB keyboards/mice failed in Windows Recovery Environment (WinRE).
A patched 7-Zip path-traversal flaw (RCE) now has public exploit code. Users must update immediately, as 7-Zip lacks auto-updates.
Microsoft's new PowerToys "Light Switch" feature, designed for automatic theme switching, is causing systems to rapidly flicker between light and dark modes.
Microsoft released an emergency update for Windows 11 (24H2/25H2) to fix the critical bug that broke localhost/127.0.0.1 authentication for developers.