Do Son A misconfigured Google Cloud Storage bucket belonging to CIEE exposed 248,725 sensitive Brazilian records, including medical reports and job videos, now published by data broker "888."
Palo Alto Networks reveals thousands of exploit attempts targeting RCE flaws in Apache Tomcat (CVE-2025-24813) and Apache Camel (CVE-2025-27636, CVE-2025-29891).
A critical flaw (CVE-2025-34067, CVSS 10.0) in HIKVISION applyCT allows unauthenticated RCE via Fastjson deserialization, risking surveillance systems. Patch immediately!
Sucuri uncovers a stealthy WordPress malware plugin that mimics your domain to inject SEO spam for bots while remaining invisible to users, evading detection.
SCATTERED SPIDER targets U.S. airlines with ransomware, vishing, and VMware exploits—CrowdStrike warns of a rising threat across cloud identities.
Cymulate reveals two flaws (CVE-2025-53110, CVE-2025-53109) in Anthropic's Filesystem MCP Server, allowing path traversal, symlink attacks, and RCE, exposing AI developer machines.
A flaw (CVE-2025-46647) in Apache APISIX's OpenID Connect plugin allows authenticated attackers to bypass token issuer validation and gain unauthorized cross-issuer access.
Wiz Research Team uncovers rapid exploitation of exposed JDWP interfaces, deploying XMRig cryptominers in TeamCity and other Java environments within hours of exposure.
A critical flaw (CVE-2025-34074, CVSS 9.4) in Lucee allows authenticated admins to achieve RCE by abusing scheduled tasks. A Metasploit module is out; urgent patching needed!
iOS 26 introduces new Communication Safety features, including full-screen warnings for sensitive content in FaceTime calls, surprisingly applying to adults and processed on-device
Google warns Pixel 6a users of battery overheating risks and will issue a mandatory update to limit charging speed and capacity. Free battery replacements are expected.
Google's AI-powered Veo 3 video generation tool is now available, enabling users to create cinematic videos with audio from text prompts via the Gemini app.
Dylan, 13, became Microsoft's youngest security researcher, uncovering a Teams flaw and prompting a Bug Bounty Program rule change. He has since submitted 20 reports.
Google & XREAL's "Project Aura" smart glasses, powered by X1S chip & Gemini AI, will launch in 2026 in Japan & US, offering enhanced AR experiences.
Microsoft drastically cut Azure startup credits from $150K to $5K for non-investor-backed firms, making eligibility stricter. The new program took effect July 1, 2025.
Microsoft announces 9,000 global layoffs, heavily impacting gaming divisions. Perfect Dark and Everwild are canceled, The Initiative studio is closed, and other studios face significant cuts.
Perplexity AI launches its $200/month "Max" subscription, offering unlimited access to Labs (creation tools), early access to Comet browser, and frontier AI models from OpenAI/Anthropic.
Over 143,000 ICS devices in the power sector are publicly exposed to the internet, facing high/critical vulnerabilities. Urgent action is needed to secure global energy infrastructure.
A NFSundown flaw (CVE-2025-38089) in the Linux kernel allows remote attackers to crash NFS servers via a NULL pointer dereference. PoC exploit is public!
Actively Exploited Google Chrome Zero-Day (CVE-2025-6554) Added to CISA’s KEV Catalog, PoC Available
Actively Exploited Google Chrome Zero-Day (CVE-2025-6554) Added to CISA’s KEV Catalog, PoC Available
Google has urgently patched a high-severity zero-day (CVE-2025-6554) in Chrome's V8 JavaScript engine. This type confusion flaw is actively exploited in the wild, risking RCE.
Pro-Russian hacktivists intensify 2025 digital assaults on Ukraine, NATO, and Western critical infrastructure, using DDoS, defacements, and targeting ICS.
Grafana warns of four critical RCE flaws in Image Renderer and Synthetic Monitoring Agent, stemming from Chromium V8 bugs. Update to patched versions immediately!