Do Son A phishing attack compromised the 'is' npm library maintainer, leading to malicious versions being published with backdoors for remote code execution. Update immediately!
Google's Android Terminal app in the latest Canary build now supports graphical Linux applications via a Debian VM, bringing a full desktop experience to your phone.
Microsoft Phone Link now offers Android users unidirectional clipboard sync from PC to phone and the ability to remotely lock their Windows 11 PCs for enhanced security.
Broadcom is restricting security updates for VMware perpetual license holders without active subscriptions, deeming them "unauthorized" and leaving them vulnerable to cyberattacks.
NVIDIA released critical security updates for GPU Display Drivers and vGPU software, patching 14 vulnerabilities that could lead to code execution, privilege escalation, or data leaks.
A highly organized Romanian criminal group, notorious for ATM "Transaction Reversal Fraud" and openly taunting police, has been dismantled by UK and Romanian authorities in a Europol-backed operation.
A misconfigured Elasticsearch server exposed hundreds of millions of detailed records on Swedish citizens and businesses, linked to fintech company Risika. The database is now secured.
cybernewswire 
Apple releases public betas for its 2025 OS lineup, featuring the new "Liquid Glass" design language, enhanced AI, and significant productivity upgrades across iPhone, iPad, Mac, and Watch.
Amazon unveils a more affordable 16GB Kindle Colorsoft and the new Kindle Colorsoft Kids, expanding its color e-reader market with features tailored for all ages.
Apple is challenging a court order to allow external App Store payment links, citing a recent Supreme Court ruling to argue judicial overreach in its ongoing battle with Epic Games.
Alphabet reports $96.4B revenue in Q2 2025, up 14% YoY, driven by strong AI performance in Google Search, YouTube, and a soaring Google Cloud
Trump's "AI Action Plan" aims to accelerate AI innovation by curbing state regulation, removing "ideological bias" from AI systems, and opening federal lands for data center development.
The Wireless Power Consortium unveils Qi2 25W, boosting wireless charging to 25 watts. iPhone 17 and major Android brands are confirmed to adopt the faster standard.
Socket discovered 10 malicious npm packages from Toptal's GitHub, exfiltrating GitHub tokens and wiping systems. The compromise vector is under investigation.
Zscaler uncovers two China-linked APT campaigns, "GhostChat" and "PhantomPrayers," targeting the Tibetan community with sophisticated spyware via fake apps and DLL sideloading.
A critical flaw (CVE-2025-54371, CVSS 7.5) in the form-data package, used by Axios 1.10.0, allows attackers to predict multipart boundaries, risking HTTP parameter pollution and injection. Update to 1.11.0 now!
Dropping Elephant is targeting Türkiye's defense industry, particularly missile manufacturers, with weaponized conference lures, VLC DLL sideloading, and custom shellcode for intelligence exfiltration.
A broken access control vulnerability (CVE-2025-24000) in Post SMTP WordPress plugin allows low-privileged users to take over administrator accounts and full sites.
Four open-source packages on npm and PyPI (56k+ downloads) are secretly deploying sophisticated spyware, performing webcam surveillance, keylogging, and credential theft.
Wiz Research uncovers Soco404, an evolving cryptojacking operation exploiting cloud misconfigurations and PostgreSQL to stealthily mine cryptocurrency across Linux and Windows.
High-Severity SQL Injection (CVE-2025-52914) in Mitel MiCollab Allows Data Access, Command Execution
High-Severity SQL Injection (CVE-2025-52914) in Mitel MiCollab Allows Data Access, Command Execution
Mitel issued patches for a high-severity SQL injection flaw (CVE-2025-52914) in MiCollab, allowing authenticated attackers to access user provisioning data and execute arbitrary database commands.