Do Son SonicWall warns of CVE-2025-40599 in SMA 100 series, allowing authenticated admins to upload arbitrary files, potentially leading to RCE.
CISA and Schneider Electric warn of critical, actively exploited RCEs in EcoStruxure Power Operation (EPO), impacting industrial control systems. Public exploits are available.
Brave Browser will now block Microsoft's AI-powered Recall feature in Windows 11 by default, extending its private Browse logic to all tabs due to privacy risks.
Arch Linux users are urged to uninstall and reinstall Firefox, LibreWolf, or Zen Web from AUR immediately due to malicious versions containing the CHAOS RAT trojan.
CISA added four actively exploited vulnerabilities—including zero-days in CrushFTP, Chrome, and SysAid—to its KEV Catalog, urging immediate remediation for critical systems.
The latest iOS 26 beta includes a curious phrase hinting at a new HomePod with a display, suggesting Apple is preparing to unveil its long-rumored visual smart speaker.
OpenAI and Oracle are partnering to build a 4.5 GW data center in the US, part of the "Stargate" initiative to meet surging AI computing demands for models like ChatGPT and Sora.
Amazon has acquired Bee AI, a startup behind an AI-powered voice wristband, signaling a deeper commitment to integrating AI into hardware and potentially enhancing Alexa and Echo devices.
AWS Kiro, the popular free AI coding tool, is facing performance issues and now implements temporary usage limits and a waitlist due to unexpectedly high demand.
A critical vulnerability (CVE-2025-7783, CVSS 9.4) in the Form-Data JavaScript library allows multipart injection and potential RCE due to predictable boundary values.
Microsoft warns that China-backed APTs (Linen Typhoon, Violet Typhoon, Storm-2603) are actively exploiting critical SharePoint zero-days (CVE-2025-49704, -49706) in unpatched on-premises servers.
CISA, FBI, and HHS issue a joint advisory on Interlock ransomware, active since Sep 2024, targeting businesses and critical infrastructure with double extortion tactics.
Proofpoint reveals a surge in RFQ scams where fraudsters impersonate procurement officials to steal high-value goods by exploiting Net 15/30/45 financing terms.
Google released an urgent Chrome update fixing two high-severity type confusion vulnerabilities (CVE-2025-8010, CVE-2025-8011) in its V8 JavaScript engine. Update immediately!
Weeks after a major takedown, Lumma Stealer has resurfaced with new stealth tactics, exploiting cracked software, fake CAPTCHAs, and GitHub to resume its credential-stealing operations.
A critical unauthenticated SSRF vulnerability (CVE-2025-54122, CVSS 10.0) in Manager.io's accounting software allows bypassing network isolation and exfiltrating sensitive data from cloud environments.
Windows 11 Insiders are testing a new local network migration feature for user files and settings, simplifying PC setup. However, installed applications still require manual reinstallation.
A new report traces China's cyber power to the "Red Hackers" of the 1990s and 2000s, who laid the groundwork for its sophisticated state-backed operations.
The Mimo threat actor has broadened its scope to Magento, employing advanced persistence, fileless execution, cryptojacking, and proxyjacking in a sophisticated new campaign.
NVIDIA announces CUDA support for RISC-V processors, expanding its AI and GPU acceleration technology to a more diverse ecosystem and strengthening its position in emerging markets.
The UK government is reportedly reconsidering its secret demand for an iCloud backdoor after US criticism and Apple's decision to disable Advanced Data Protection for UK users.
AmateraStealer (formerly ACRStealer) has significantly evolved, using low-level NTAPIs, Heaven's Gate, and multi-layered encryption to evade detection and steal sensitive data.