Do Son Dropping Elephant is targeting Türkiye's defense industry, particularly missile manufacturers, with weaponized conference lures, VLC DLL sideloading, and custom shellcode for intelligence exfiltration.
A broken access control vulnerability (CVE-2025-24000) in Post SMTP WordPress plugin allows low-privileged users to take over administrator accounts and full sites.
Four open-source packages on npm and PyPI (56k+ downloads) are secretly deploying sophisticated spyware, performing webcam surveillance, keylogging, and credential theft.
Wiz Research uncovers Soco404, an evolving cryptojacking operation exploiting cloud misconfigurations and PostgreSQL to stealthily mine cryptocurrency across Linux and Windows.
High-Severity SQL Injection (CVE-2025-52914) in Mitel MiCollab Allows Data Access, Command Execution
High-Severity SQL Injection (CVE-2025-52914) in Mitel MiCollab Allows Data Access, Command Execution
Mitel issued patches for a high-severity SQL injection flaw (CVE-2025-52914) in MiCollab, allowing authenticated attackers to access user provisioning data and execute arbitrary database commands.
A critical flaw (CVE-2025-41240, CVSS 10.0) in Bitnami Helm charts exposes Kubernetes secrets via publicly accessible paths, allowing unauthenticated remote access. Update immediately!
Mitel warns of a critical authentication bypass vulnerability in MiVoice MX-ONE's Provisioning Manager, allowing unauthenticated attackers unauthorized access to accounts.
A high-severity flaw (CVE-2025-8069) in AWS Client VPN for Windows allows local users to escalate privileges due to an OpenSSL config file path vulnerability.
T-Mobile and Starlink officially launch "T-Satellite," bringing basic mobile messaging to remote and disaster-stricken areas of the US via 650+ low-Earth orbit satellites.
Proton introduces Lumo AI Assistant, an end-to-end encrypted AI tool that guarantees no user data is used for training, offers a "Ghost Mode," and runs on open-source models in Europe.
Apple introduces AppleCare One, a new $20/month subscription covering up to three Apple devices. It streamlines protection and allows enrollment for devices up to four years old.
The UK government is drafting new legislation to criminalize ransomware payments by public sector bodies (NHS, schools, councils) to deter attacks and cut off funding to cybercriminals.
SonicWall SMA 100 series has buffer overflow and XSS flaws (CVSS 6.3-7.3) exploitable by unauthenticated attackers via the web interface. Update to 10.2.2.1-90sv immediately!
Weidmueller IE-SR-2TX series security routers have critical flaws (CVSS 9.8) allowing unauthenticated RCE and buffer overflows, risking industrial automation and critical infrastructure.
TP-Link warns of two critical command injection flaws (CVE-2025-7723, -7724) in VIGI NVRs, allowing remote attackers to execute arbitrary commands, even unauthenticated. Update immediately.
Synology BeeDrive desktop app for Windows has three high-severity vulnerabilities (CVSS 7.5-7.8) allowing local code execution and remote arbitrary file deletion.
CYFIRMA uncovers EdskManager RAT, a sophisticated remote access trojan using HVNC, multi-stage execution, and advanced persistence for covert, long-term system access.
Akamai confirms Coyote, a Latin America-focused banking trojan, is the first malware to exploit Microsoft's UI Automation (UIA) framework in the wild for credential theft.
A critical vulnerability in ASUSTOR's Windows apps, ASUSTOR Backup Plan and EZSync, allows local attackers to gain SYSTEM privileges via unquoted service paths.
Dahua IP cameras are vulnerable to two high-severity buffer overflow flaws (CVE-2025-31700, CVE-2025-31701) allowing remote attackers to crash devices or execute arbitrary code. Update firmware immediately.
18 severe vulnerabilities (CVSS up to 9.8) found in Samsung MagicINFO 9 Server allow RCE, web shell uploads, and auth bypass via hardcoded credentials. Update immediately!
Italian researchers developed "WhoFi," an AI-powered system using Wi-Fi signal reflections from the human body to identify individuals with 95.5% accuracy, even without devices.