Do Son CERT Polska warns of a critical Roundcube XSS flaw (CVE-2024-42009) exploited by UNC1151 in spear phishing, stealing credentials and compromising Polish organizations.
CYFIRMA uncovers DuplexSpy, a powerful C# RAT on GitHub with surveillance, persistence, and anti-analysis features, posing a significant cybercrime threat.
Two malicious npm packages, express-api-sync and system-health-sync-api, act as remote-controlled time bombs, wiping entire directories with a single POST request.
Researchers found Meta and Yandex secretly tracked Android users via localhost, linking web activity to app IDs, even in Incognito. This widespread abuse bypassed privacy controls.
Go 1.24.4 and 1.23.10 fix flaws in net/http, os, and crypto/x509, addressing data leaks, file inconsistencies, and certificate validation bypasses. Update now!
An old Microsoft Office vulnerability (CVE-2017-0199) is being exploited in a new phishing campaign to deploy the FormBook infostealer malware. Update now!
"EnigmaCyberSecurity" is a new multi-stage cybercrime campaign hitting Brazil and beyond, using phishing, malicious extensions, and RATs to steal banking data.
CVE-2025-4318 (CVSS 9.5) hits AWS Amplify Codegen UI with PoC exploit. RCE flaw puts CI/CD pipelines and developer environments at high risk.
A new Mirai botnet variant is exploiting CVE-2024-3721 to infect vulnerable DVRs. Learn how this sophisticated attack works and if your surveillance system is at risk.
A new Android malware disguised as "PM KISAN YOJNA" is stealing sensitive data using multi-stage droppers and evasion tactics. Beware of fake updates!
Explore a critical vBulletin RCE vulnerability stemming from a flawed patch. This article details the PHP Object Injection leading to RCE, complete with a PoC
Discover the inside story of AI-powered hackers-for-hire in 2025, and how machine learning is reshaping account breaches, defenses, and the entire security industry.
Enthusiasts found a userland exploit in the new Nintendo Switch 2, altering program behavior. Nintendo maintains a strict stance on modifications.
A high-severity XSS flaw (CVE-2025-5806) in Jenkins Gatling Plugin bypasses CSP, risking session hijacking and credential theft. Downgrade to v1.3.0 immediately!
Anthropic unveils Claude Gov, an AI model for US national security, deployed in classified environments for intelligence and defense operations.
Court denies Apple's bid to delay external purchase links, ordering an immediate halt to fees and "intimidation" tactics. The "Apple tax" is over!
Symantec reveals popular Chrome extensions like Browsec VPN & DualSafe Password Manager are leaking sensitive user data over unencrypted HTTP, risking privacy.
Proofpoint reveals TA397 (Bitter APT) is an India-aligned state-backed group conducting long-term espionage campaigns globally, targeting rivals and partners.
A sophisticated spear-phishing campaign using Signal targeted Armenian civil society and government in March 2025, linked to threat actor UNC5792.
CISA issues critical warning for CyberData SIP Emergency Intercom (Model 011209) with severe vulnerabilities (CVSS 9.8), risking remote access and code execution. Update now.
iVerify uncovered "NICKNAME," a zero-click iMessage vulnerability linked to state-sponsored surveillance on high-value targets in the US & EU, now patched.
Apple Intelligence faces delays in China due to regulatory hurdles and escalating US-China trade tensions, impacting its rollout and iPhone sales.