Do Son Unauthenticated RCE flaw in Mitel SIP phones (CVSS 9.8) lets attackers gain root via ringtone upload. Exploit PoC shows full system compromise.
Five critical flaws (CVSS 9.8) in Blink routers allow unauthenticated remote root code execution via command injection in web server components.
Insikt Group reveals Predator spyware's resurgence, with new infrastructure, obfuscation, and a previously unreported customer in Mozambique, despite sanctions.
Anubis, a new RaaS, combines ECIES encryption with a "wipe mode" that permanently destroys files. It's actively targeting healthcare, construction, and engineering sectors.
Critical flaws (CVE-2025-6029, CVE-2025-6030) in KIA Ecuador key fobs allow remote vehicle unlocking and control via insecure learning code technology.
Katz Stealer, a new stealthy MaaS, is actively stealing data from browsers, crypto wallets, and apps, using advanced evasion tactics like steganography and Discord hijacking.
A high-severity flaw (CVE-2025-33108) in IBM BRMS for i allows users with specific capabilities to gain elevated privileges. Update to PTF SJ05907 (7.5) or SJ05906 (7.4).
HijackLoader and DeerStealer are surging, using ClickFix social engineering and sophisticated evasion to bypass defenses and exfiltrate sensitive data.
Censys uncovers "sostener.vbs," an obfuscated VBScript launching a multi-stage RAT delivery pipeline, affecting dozens and potentially linked to Blind Eagle APT.
"SmartAttack" reveals a new threat: smartwatches can act as covert ultrasonic receivers, exfiltrating data from air-gapped systems via sound waves.
Infoblox unmasks VexTrio, a sprawling malicious adtech ecosystem intertwined with DNS-based malware campaigns and global website compromises, fueled by commercial operators
Four flaws in libxml2 (CVE-2025-6021, CVE-2025-49794, CVE-2025-49795, CVE-2025-49796) expose systems to memory corruption, RCE, and DoS attacks.
Attackers are hijacking expired Discord invite links, redirecting users to malicious servers that deploy AsyncRAT and crypto-stealing Skuld Stealer via clever social engineering.
A spoofing flaw (CVE-2025-26685) in Microsoft Defender for Identity, combined with other vulnerabilities, enables unauthenticated privilege escalation to Active Directory.
Meta invested $14.3B in Scale AI, recruiting founder Alexandr Wang to lead its Superintelligence Lab, aiming to accelerate AGI development.
macOS 26 introduces ASIF, a new sparse disk image format for Apple Silicon, dramatically improving VM read/write speeds and storage efficiency
Mattel partners with OpenAI to integrate generative AI into iconic toys like Barbie for enhanced interaction and streamline internal operations. First products due end-year
Apple confirms a complete Siri redesign, but the revamped AI assistant may not arrive until iOS 26.4 in Spring 2026, facing accusations of misleading marketing.
3DMark is now natively available for macOS, offering accurate performance benchmarking for Apple Silicon Macs with Wild Life Extreme, Solar Bay, and Steel Nomad tests.
Apple is developing a new API to enable automatic login for video subscription accounts on Apple TV, streamlining sign-ins for users already authenticated on iOS/iPadOS.
A critical Windows SMB client flaw (CVE-2025-33073, CVSS 8.8) allows remote SYSTEM privilege escalation via Kerberos authentication. PoC available.
A medium-severity flaw (CVE-2025-3415) in Grafana Alerting exposes sensitive DingDing contact point URLs to viewers. Update to patch or disable the integration