Do Son
Socket’s Threat Research Team has uncovered a massive supply-chain abuse campaign leveraging npm’s public registry and unpkg.com’s...
cybernewswire 
A UAF flaw in the Linux kernel TLS subsystem allows a low-privileged user to gain RCE by exploiting memory corruption during asynchronous decryption.
Google has confirmed that the Gemini Nano on-device AI model is blocked from running on Android devices with an unlocked bootloader, citing a feature not found error.
Google/Mandiant linked CL0P extortion to a Zero-Day RCE flaw (CVE-2025-61882) in Oracle E-Business Suite. Attackers exploited the bug since July to steal corporate data and deploy GOLDVEIN Java shells.
A Zero-Day LFI flaw (CVE-2025-11371) in Gladinet/Triofox is being actively exploited. Attackers retrieve the Web.config machine key to chain into an unauthenticated RCE exploit.
NVIDIA released an urgent update for its GPU Display Driver, fixing multiple high-severity flaws including RCE via an uncontrolled DLL loading path (CVE-2025-23309). Update now.
Trend Micro discovered RondoDox, a new botnet leveraging 50+ exploits (including the Pwn2Own TP-Link flaw) in an "exploit shotgun" approach to compromise routers, DVRs, and IoT globally.
Cisco Talos confirms Storm-2603 is abusing the DFIR tool Velociraptor for persistence and arbitrary code execution, deploying LockBit and Babuk ransomware against VMware and Windows servers.
MediaTek's October Security Bulletin discloses multiple High-severity flaws in its WLAN and GNSS chipsets, including buffer and stack overflows that risk RCE via memory corruption.
Expel uncovered a phishing attack using Cache Smuggling to deliver malware. The technique uses a fake Fortinet lure and PowerShell to execute a payload staged in the browser's cache, bypassing network detection.
Researchers from Palo Alto Networks Unit 42 have discovered a new phishing trend where attackers trick victims...
A flaw (CVE-2023-28760) in TP-Link AX1800 routers allows unauthenticated attackers on the LAN to gain root RCE by manipulating the MiniDLNA service via a USB drive.
Huntress exposed a covert campaign using log poisoning on exposed phpMyAdmin to deploy a web shell and the Nezha monitoring tool, ultimately delivering the Ghost RAT backdoor to 100+ victims in Asia.
Palo Alto, California, 9th October 2025, CyberNewsWire
Newark, United States, 9th October 2025, CyberNewsWire
Sam Altman revealed OpenAI is creating an "AI closed-loop economy," leveraging cross-investments from NVIDIA and AMD to fund a planned $1 trillion AI computing and infrastructure empire.
Microsoft Word's Windows preview build will now default to OneDrive and AutoSave for new documents, mirroring Microsoft's broader strategy to drive cloud storage and synchronization.
GitHub added support for Sign in with Apple, allowing users to create accounts instantly and use a randomized relay email address for enhanced privacy protection.
Esri released a patch for a Critical (CVSS 10.0) SQL Injection flaw in ArcGIS Server v11.3, 11.4, and 11.5 that allows RCE and data access. Update immediately.
1Password launched Secure Agentic Autofill to prevent AI agents from accessing credentials. It uses Touch ID for approval, creating a secure, human-in-the-loop workflow for web automation.
Flowise patched a Critical (CVSS 10.0) RCE flaw (CVE-2025-61913) in WriteFileTool. Authenticated attackers can write arbitrary files to the filesystem to gain command execution.