Do Son A flaw (CVE-2023-28760) in TP-Link AX1800 routers allows unauthenticated attackers on the LAN to gain root RCE by manipulating the MiniDLNA service via a USB drive.
Huntress exposed a covert campaign using log poisoning on exposed phpMyAdmin to deploy a web shell and the Nezha monitoring tool, ultimately delivering the Ghost RAT backdoor to 100+ victims in Asia.
cybernewswire
Palo Alto, California, 9th October 2025, CyberNewsWire
Newark, United States, 9th October 2025, CyberNewsWire
Sam Altman revealed OpenAI is creating an "AI closed-loop economy," leveraging cross-investments from NVIDIA and AMD to fund a planned $1 trillion AI computing and infrastructure empire.
Microsoft Word's Windows preview build will now default to OneDrive and AutoSave for new documents, mirroring Microsoft's broader strategy to drive cloud storage and synchronization.
GitHub added support for Sign in with Apple, allowing users to create accounts instantly and use a randomized relay email address for enhanced privacy protection.
Esri released a patch for a Critical (CVSS 10.0) SQL Injection flaw in ArcGIS Server v11.3, 11.4, and 11.5 that allows RCE and data access. Update immediately.
1Password launched Secure Agentic Autofill to prevent AI agents from accessing credentials. It uses Touch ID for approval, creating a secure, human-in-the-loop workflow for web automation.
Flowise patched a Critical (CVSS 10.0) RCE flaw (CVE-2025-61913) in WriteFileTool. Authenticated attackers can write arbitrary files to the filesystem to gain command execution.
IBM and Anthropic partnered to embed Claude AI into a new IDE for enterprise software development, with early internal testing reporting an average 45% developer productivity boost.
Users are reporting faint static, distortion, and volume issues on the iPhone 17 Pro Max speakers. The static noise is most noticeable when the device is connected to a USB-C charger.
Apple detailed its compliance with the Texas age verification law (SB2420). Starting Jan. 2026, all new accounts will require age checks, with parental consent for all app downloads.
Elon Musk has settled the $128M lawsuit with former Twitter executives over unpaid severance. The undisclosed agreement is contingent on Musk fulfilling set conditions by Oct 31.
Volexity found China-aligned APT UTA0388 used ChatGPT to generate multilingual spear-phishing lures and assist in GOVERSHELL malware development for espionage.
GitLab patched two high-severity flaws: CVE-2025-11340 (Auth Bypass) allows API write access with read-only tokens, and CVE-2025-10004 permits unauthenticated DoS via GraphQL.
FortiGuard uncovered Chaos-C++, a dangerous new ransomware strain. It deletes file content over 1.3 GB and uses clipboard hijacking to steal Bitcoin during payments.
CrowdStrike patched two flaws in Falcon Sensor for Windows (CVE-2025-42701). Attackers with local code execution can delete arbitrary files, risking system stability.
Deno patched a High-severity flaw (CVE-2025-61787) allowing Command Injection on Windows when spawning batch files. Attackers can execute arbitrary commands via malicious arguments.
Microsoft Threat Intelligence details how APTs abuse Teams and Entra ID integration for recon, vishing, and C2. Attackers use RMM tools and spoofed accounts to breach enterprise environments.
Rapid7 identified the Crimson Collective using TruffleHog to find leaked AWS IAM keys. The group achieves Admin access to steal data from RDS/S3 and extort victims.
Akka.NET patched a Critical (CVSS 9.3) flaw in Akka.Remote (CVE-2025-61778). Missing mutual TLS allows unauthenticated, untrusted clients to connect to secure clusters.