Do Son A critical flaw (CVE-2025-41240, CVSS 10.0) in Bitnami Helm charts exposes Kubernetes secrets via publicly accessible paths, allowing unauthenticated remote access. Update immediately!
Mitel warns of a critical authentication bypass vulnerability in MiVoice MX-ONE's Provisioning Manager, allowing unauthenticated attackers unauthorized access to accounts.
A high-severity flaw (CVE-2025-8069) in AWS Client VPN for Windows allows local users to escalate privileges due to an OpenSSL config file path vulnerability.
T-Mobile and Starlink officially launch "T-Satellite," bringing basic mobile messaging to remote and disaster-stricken areas of the US via 650+ low-Earth orbit satellites.
Proton introduces Lumo AI Assistant, an end-to-end encrypted AI tool that guarantees no user data is used for training, offers a "Ghost Mode," and runs on open-source models in Europe.
Apple introduces AppleCare One, a new $20/month subscription covering up to three Apple devices. It streamlines protection and allows enrollment for devices up to four years old.
The UK government is drafting new legislation to criminalize ransomware payments by public sector bodies (NHS, schools, councils) to deter attacks and cut off funding to cybercriminals.
SonicWall SMA 100 series has buffer overflow and XSS flaws (CVSS 6.3-7.3) exploitable by unauthenticated attackers via the web interface. Update to 10.2.2.1-90sv immediately!
Weidmueller IE-SR-2TX series security routers have critical flaws (CVSS 9.8) allowing unauthenticated RCE and buffer overflows, risking industrial automation and critical infrastructure.
TP-Link warns of two critical command injection flaws (CVE-2025-7723, -7724) in VIGI NVRs, allowing remote attackers to execute arbitrary commands, even unauthenticated. Update immediately.
Synology BeeDrive desktop app for Windows has three high-severity vulnerabilities (CVSS 7.5-7.8) allowing local code execution and remote arbitrary file deletion.
CYFIRMA uncovers EdskManager RAT, a sophisticated remote access trojan using HVNC, multi-stage execution, and advanced persistence for covert, long-term system access.
Akamai confirms Coyote, a Latin America-focused banking trojan, is the first malware to exploit Microsoft's UI Automation (UIA) framework in the wild for credential theft.
A critical vulnerability in ASUSTOR's Windows apps, ASUSTOR Backup Plan and EZSync, allows local attackers to gain SYSTEM privileges via unquoted service paths.
Dahua IP cameras are vulnerable to two high-severity buffer overflow flaws (CVE-2025-31700, CVE-2025-31701) allowing remote attackers to crash devices or execute arbitrary code. Update firmware immediately.
18 severe vulnerabilities (CVSS up to 9.8) found in Samsung MagicINFO 9 Server allow RCE, web shell uploads, and auth bypass via hardcoded credentials. Update immediately!
Italian researchers developed "WhoFi," an AI-powered system using Wi-Fi signal reflections from the human body to identify individuals with 95.5% accuracy, even without devices.
Windows 11 24H2's new KB5062660 update introduces "Quick Machine Recovery" for automatic system fixes and a faster, redesigned Black Screen of Death.
GitLab patched multiple high-severity XSS and data exposure vulnerabilities in CE/EE, urging users to update to 18.2.1, 18.1.3, or 18.0.5.
A critical SharePoint Server RCE (CVE-2025-53770) is actively exploited. A Metasploit module is now public, amplifying the urgency for immediate patching.
The suspected administrator of xss.is, a notorious Russian-speaking cybercrime forum, has been arrested in Ukraine after a joint operation by French police and Europol.
SonicWall warns of CVE-2025-40599 in SMA 100 series, allowing authenticated admins to upload arbitrary files, potentially leading to RCE.