Do Son The Qt Group patched two critical flaws in Qt SVG: a UAF bug (CVE-2025-10729) that risks RCE, and recursive pattern element (CVE-2025-10728) leading to stack overflow DoS.
Elastic patched five flaws in Kibana/Elasticsearch, including three Critical XSS issues (CVE-2025-25009) and credential leaks, urging immediate upgrades to v8.18.8+.
CrowdStrike warns that the Critical RCE zero-day (CVE-2025-61882) in Oracle E-Business Suite is being actively exploited by GRACEFUL SPIDER (Clop affiliate) for corporate data theft. Patch immediately.
A Critical (CVSS 9.7) DNS rebinding flaw (CVE-2025-59159) in the SillyTavern LLM interface allows remote attackers to seize full control of local AI instances and steal API keys.
A Critical (CVSS 10.0) zero-day RCE flaw (CVE-2025-10035) in GoAnywhere MFT is being actively exploited by the Medusa ransomware group, Storm-1175. Patch immediately.
IBM patched a Critical (CVSS 9.3) LPE flaw (CVE-2025-36356) in Verify Access/Identity Access that allows locally authenticated users to escalate privileges to root. Update to v10.0.9.0-IF3 now.
Rapid7 exposed the unauthenticated RCE chain in Cisco ASA/FTD. CVE-2025-20362 bypasses auth to reach CVE-2025-20333, a buffer overflow in the WebVPN Lua script. Patch immediately.
A critical UAF flaw in the Linux Traffic Control subsystem (CVE-2023-4921, CVSS 7.8) allows local privilege escalation to root. A fully detailed PoC exploit has been released.
A Chinese APT used fake Cloudflare verification pages and malicious LNK files to inject PlugX via DLL sideloading into a Serbian aviation agency, aiming for long-term espionage.
CYFIRMA uncovered Yurei Ransomware, a sophisticated Go-based double-extortion threat that uses ChaCha20 encryption, anti-forensic wipes, and disguises itself as WindowsUpdate.exe to propagate over SMB.
APT SideWinder launched Operation SouthNet, targeting South Asia with over 50 malicious phishing portals hosted on Netlify and pages.dev to steal government and military credentials.
Synacktiv exposed a critical flaw chain in Snipe-IT. A low-privileged user can exploit a Stored XSS (CVE-2025-59712) to hijack admin sessions and trigger RCE (CVE-2025-59713) via unsafe deserialization.
cybernewswire 
Google unveiled StreetViewAI, an AI system using Gemini Flash 2.0 to provide visually impaired users with conversational, real-time descriptions and navigational cues for Street View images.
The highly anticipated AI device from OpenAI and Jony Ive may be delayed past 2026 due to unresolved issues concerning the AI’s personality, privacy demands, and high compute costs.
A flaw in the Unity Runtime (CVE-2025-59489) allows local code execution in games via DLL injection through the Android intent handler. Developers must rebuild their apps.
Qualcomm Antitrust Trial Begins: UK Consumer Group Seeks £480 Million for Inflated Smartphone Prices
Qualcomm Antitrust Trial Begins: UK Consumer Group Seeks £480 Million for Inflated Smartphone Prices
The UK consumer group Which? filed a £480M lawsuit against Qualcomm, alleging the chipmaker used its dominance to charge excessive fees, inflating prices for Apple and Samsung users.
A Critical flaw (CVE-2025-11230) in HAProxy’s mjson number parser allows unauthenticated attackers to cause a Denial of Service with a single crafted JSON payload. Update immediately.
OpenAI has acquired Roi, an AI investment app, and its CEO, Sujith Vishwajith, to enhance ChatGPT's functionality with personalized financial advice and portfolio management.
The TamperedChef malware campaign used a trojanized PDF editor, delivered via malvertising, to stealthily harvest browser credentials after operating undetected for two months.
A newly disclosed vulnerability in the Zabbix Agent and Agent 2 for Windows could allow local attackers...
The "Trinity of Chaos" alliance (Lapsus$, Scattered Spider, ShinyHunters) launched a DLS, listing 39 firms, including Google and Cisco, and claiming 1.5 billion stolen records.