Do Son A joint advisory from US, UK, Canada, and Australia warns of Scattered Spider's evolving tactics, now using DragonForce ransomware, spearphishing, SIM swapping, and MFA fatigue to compromise systems.
Critical Flaw in Wix’s New AI Platform Base44 Allowed Unauthorized Access to Private Enterprise Apps
Critical Flaw in Wix’s New AI Platform Base44 Allowed Unauthorized Access to Private Enterprise Apps
Wiz Research uncovered a critical flaw in Wix's new AI platform, Base44, that allowed unauthorized access to private enterprise applications and sensitive data by bypassing SSO.
A critical RCE flaw (CVE-2025-5394, CVSS 9.8) in the Alone WordPress theme allows unauthenticated attackers to upload arbitrary files and gain full site control. Exploitation is confirmed in the wild.
Trend Micro reports Gunra ransomware has expanded to Linux, employing 100 parallel encryption threads, partial encryption, and stealthy keystore methods to target global enterprises.
Seychelles Commercial Bank (SCB) suffered a cyberattack exposing 1.4M+ customer PII, including government employee data. Resecurity suspects espionage, not just financial gain, given the low data sale price.
The EOL TP-Link Archer C50 router has a critical hardcoded DES key (CVE-2025-6982), allowing attackers to decrypt sensitive configuration files, including admin credentials and Wi-Fi passwords.
Trellix uncovers 0bj3ctivityStealer, a sophisticated info-stealer using phishing, custom PowerShell, and steganography to evade detection and exfiltrate sensitive data.
BeyondTrust patches two high-severity LPE flaws (CVE-2025-2297, CVE-2025-6250) in Privilege Management for Windows, allowing local attackers to gain SYSTEM privileges via user profile manipulation and WMIC exploit.
Cyfirma reveals Raven Stealer, a new, lightweight MaaS infostealer built in Delphi/C++, using reflective process hollowing and Telegram bots for stealthy data exfiltration from browsers.
ChatGPT agents are now capable of bypassing Cloudflare Turnstile CAPTCHA verification, automatically clicking checkboxes and demonstrating a new level of AI-driven anti-bot system evasion.
SonicWall discloses CVE-2025-40600, a critical format string vulnerability in SonicOS SSL VPN, allowing unauthenticated remote DoS attacks on Gen7 firewalls. Update to 7.3.0-7012 or later.
Windows 11 Beta and Dev builds now show image search results with visual previews directly in the search box, based on local index data, for a more intuitive experience.
NVIDIA's Sasha Levin proposes new guidelines for AI in Linux kernel development, including a "Co-developed-by" tag and standardized configurations for AI coding tools like Claude and Copilot.
Google released a Chrome Stable Channel update patching CVE-2025-8292, a high-severity Use-After-Free vulnerability in its Media Stream component. Update immediately!
Qualcomm unveils Wi-Fi 8 (802.11bn), focusing on "Ultra High Reliability" to deliver wired-like stability, with 25% lower latency and packet loss for AI, IoT, and enterprise automation.
cybernewswire 
Trae IDE, an AI-powered programming tool and integrated development environment (IDE) developed by ByteDance, has recently come...
Microsoft Edge introduces "Copilot Mode," an experimental AI feature allowing the assistant to analyze all open tabs and Browse history for enhanced, context-aware assistance.
Google Chrome now displays AI-generated review summaries for online stores, helping US users quickly assess retailer credibility and product quality from multiple rating platforms.
PayPal introduces "Pay with Crypto," allowing US merchants to accept over 100 cryptocurrencies, with funds converting to fiat or PYUSD at low transaction fees (0.99% for first year).PayPal, Crypto Payments, Cryptocurrency, Merchants, Bitcoin, Ethereum, PYUSD, Stablecoin, Transaction Fees, US
Microsoft discovered "Sploitlight" (CVE-2025-31199), a macOS flaw exploiting Spotlight plugins to bypass TCC, leading to private data exfiltration, including Apple Intelligence cached info.
ASUS has patched two high-severity flaws (CVE-2025-4569, CVE-2025-4570) in MyASUS, stemming from insecure token storage that could lead to unauthorized access. Update immediately!