Do Son Mandiant Red Team breached Aviatrix Controller via auth bypass & RCE flaws CVE-2025-2171/2172—reached root, gained AWS keys. Full chain, no guesswork.
Critical CVSS 9.9 RCE, IDOR, and path traversal flaws in InnoShop with full PoC exploit. No patch available—eCommerce sites at serious risk.
Hackers are weaponizing legitimately signed ConnectWise ScreenConnect installers by using Authenticode stuffing to deploy malware and fake updates, leveraging social engineering.
NCSC reveals SHOE RACK, a stealthy post-exploitation malware using reverse SSH tunneling, DoH, and protocol abuse to maintain remote access on FortiGate 100D firewalls.
Pro-Iranian group Cyber Fattah leaked thousands of sensitive Saudi Games participant records, including PII and bank data, in a political information operation targeting Saudi Arabia.
Kaspersky uncovers SparkKitty mobile spyware, which infiltrates Android/iOS via TikTok mods and crypto apps, using image recognition to steal sensitive photos like crypto seed phrases.
North Korean APT Kimsuky is using GitHub private repos, Dropbox, and XenoRAT malware via spearphishing to compromise victims and conduct cyber-espionage.
A new Android spyware campaign uses a "Wedding Invitation" APK via WhatsApp to install SpyMax RAT, stealing OTPs, contacts, and banking credentials from Indian users.
cybernewswire
Newark, United States, 23rd June 2025, CyberNewsWire
CoinTelegraph was hacked on June 22, 2025, with attackers injecting malicious JavaScript to display fake CTG airdrop pop-ups, stealing crypto by draining connected wallets.
CoinMarketCap suffered a client-side attack on June 20, 2025, using a fake "doodle" graphic to deliver Inferno Drainer, stealing over $43,000 from user wallets.
YouTube is experimenting with "fake buffering" via A/B testing, intentionally delaying video loading by ~10 seconds for ad-blocking users to encourage Premium subscriptions.
Microsoft shortens Windows 11 24H2 System Restore point retention to 60 days, purging older points. This follows a previous reduction in Windows 10's rollback window.
CapCut's updated TOS (June 12, 2025) grants ByteDance a perpetual, worldwide license to use user content, including likeness and voice, for any purpose without compensation or approval.
iOS 26 is testing "Captive Assist," a new feature to synchronize public Wi-Fi logins across all your Apple devices, streamlining access to captive networks.
Apple is reportedly in talks to acquire Perplexity AI, aiming to accelerate its AI search engine development and integrate generative AI into the next generation of Siri.
Cloudflare successfully mitigated a record-breaking 7.3 Tbps DDoS attack in May 2025, delivering 37.4 TB in 45 seconds with no service disruption.
Microsoft Family Safety is automatically blocking Google Chrome (v137.0.7151.68/69) in Windows 11. Learn why and how to manually unblock the browser.
Microsoft is purging old drivers from Windows Update, offering a cleaner experience. But will this new OEM-focused policy lead to unexpected compatibility issues?
A critical flaw (CVE-2025-4517, CVSS 9.4) in Python's tarfile module allows arbitrary file reads/writes outside the extraction directory. PoC is public; update immediately
Confucius APT has a new modular backdoor, "Anondoor," delivering espionage payloads and evading sandboxes in targeted attacks on South and East Asian governments.
The Prometei botnet is back with a stealthy Linux variant, actively mining Monero and stealing credentials. It uses DGA, custom UPX packing, and sophisticated anti-analysis techniques.