Do Son A new report reveals a multi-stage phishing campaign distributing DarkCloud Stealer. The malware hides its loader in a JPG file and injects code into MSBuild.exe for stealth.
A critical flaw in the Case Theme User WordPress plugin (CVSS 9.8) allows unauthenticated attackers to hijack admin accounts. The vulnerability is under active exploitation.
A new report reveals HijackLoader, a Malware-as-a-Service loader. It uses advanced evasion and anti-analysis techniques to deliver stealers and other payloads.
A new report reveals Maranhão Stealer, a new malware targeting the gaming community through pirated software and cheats. It steals crypto, credentials, and data.
Two medium-severity flaws in Spring Security and the Spring Framework allow authorization bypasses in applications that use method-level security on generic types.
A new report details a 0-click RCE exploit chain in the Linux kernel's ksmbd module that allows an authenticated user to gain root access. A PoC has been published.
North Korean threat group Kimsuky is using AI-generated deepfakes in a new spear-phishing campaign, signaling a new frontier in cyber warfare.
A new ransomware group, Yurei, is using open-source malware to attack businesses in Asia and Africa. The group is using a double-extortion model to pressure victims.
A new report reveals a malware campaign using SEO poisoning to target Chinese-speaking users. Attackers use fake software sites to deliver Hiddengh0st and Winos.
The Trump administration is expected to grant a fourth extension to the TikTok "sell-or-ban" deadline, providing the app with more time to find a U.S. buyer.
OpenAI launches Grove, a new incubator program designed to help founders at the ideation stage of their AI startups. The program offers exclusive access to tools and mentorship.
Qualcomm has officially unveiled the Snapdragon 8 Elite Gen 5, and Xiaomi will be the first to launch it in its upcoming Xiaomi 17 series this September.
Microsoft Research has unveiled an Analog Optical Computer that uses light for calculations. The device is up to 100 times more energy-efficient than GPUs for AI workloads.
Critical Squid SNMP flaw CVE-2025-59362 lets attackers exploit a stack-based buffer overflow to execute arbitrary code or crash systems.
Samsung has released an emergency patch for a critical zero-day vulnerability (CVE-2025-21043) actively exploited in Android devices. Update now to protect against RCE attacks.
Windows 11 is getting a built-in network speed test, but a closer look reveals it's just a shortcut to a Bing web page. Is it a real improvement?
A critical flaw (CVE-2025-58434) in FlowiseAI allows unauthenticated attackers to hijack any account. The bug has a CVSS 9.8 score, and a PoC has been released.
The FBI has issued a FLASH Alert warning about UNC6040 and UNC6395, two groups actively compromising Salesforce via vishing and malicious OAuth apps to steal data.
Penske Media is suing Google over AI Overviews, claiming the feature unlawfully uses its content and has caused a significant drop in traffic and revenue for its sites.
Google unveils VaultGemma, the first LLM trained with differential privacy. The open-source model achieves near non-private performance, setting a new standard for privacy-first AI.
Two critical vulnerabilities (CVSS 10 & 9.8) in Digiever NVRs allow unauthenticated attackers to steal credentials and execute commands. Update your firmware immediately.
Researchers expose BaoLoader, a malware operation that has systematically used at least 26 code-signing certificates over seven years to appear legitimate and bypass security.