Do Son Microsoft announces new AI-powered features for "Copilot+ PC," including natural language settings search and the "Click to Do" function, enhancing Windows 11.
A critical vulnerability in Kibana (CVE-2025-25014) enables arbitrary code execution via prototype pollution. Elastic urges users to patch immediately.
Akamai uncovers active exploitation of retired GeoVision IoT devices via CVE-2024-6047 and CVE-2024-11120 using Mirai-based botnet LZRD.
CVE-2025-46728 in cpp-httplib allows memory exhaustion via chunked requests. Patch to v0.20.1 to prevent denial-of-service attacks.
CVE-2025-47241 in Browser Use lets attackers bypass whitelists via crafted URLs. Upgrade to v0.1.45 to secure AI-driven browser automation.
The CoGUI phishing kit uses advanced evasion to target Japan with high-volume campaigns impersonating Amazon, PayPay, and more.
OpenCTI flaw CVE-2025-24977 allows RCE and secret exposure via webhooks. Patch to v6.4.11 to protect Docker/Kubernetes deployments.
UNC3944 resurfaces as Scattered Spider, linked to DragonForce and RansomHub in new retail attacks. Mandiant warns of social engineering escalation.
CYFIRMA's analysis details Gunra Ransomware's sophisticated techniques, including evasion and data exfiltration, impacting global industries.
Critical security vulnerability (CVE-2025-4318) in AWS Amplify Studio allows arbitrary code execution. Upgrade to version 2.20.3 immediately!
Resecurity exposes Panda Shop smishing kit linked to Chinese cybercrime, targeting millions via iMessage and RCS with carding and data theft.
Research reveals the widely used open source library 'easyjson' is controlled by developers linked to Russia's VK Group, raising security concerns.
OpenAI will remain a non-profit, shifting its LLC to a Public Benefit Corporation. This balances investor returns with societal interests amid scrutiny.
A critical security flaw in the OttoKit WordPress plugin (100,000+ installs) is under active exploit. Update immediately to prevent website compromise.
Google NotebookLM now offers voice summaries in over 50 languages and is launching a standalone app on May 20! Summarize documents & more with AI.
Apple has filed an appeal against the recent court ruling in the Epic Games lawsuit regarding App Store policies in the United States.
A preauth DoS flaw in Windows Deployment Services allows attackers to crash systems via spoofed UDP packets, warns researcher Zhiniang Peng.
A critical XXE vulnerability (CVE-2025-2905) in WSO2 API Manager allows attackers to read files and cause DoS. Patch WSO2-2016-0151 is the solution.
A critical vulnerability (CVE-2025-2605) in Honeywell MB-Secure alarm panels allows attackers to execute OS commands. Update to the latest version now.
mnemonic exposes Darcula, a global phishing-as-a-service network using the Magic Cat toolkit to target mobile users with encrypted, real-time scam dashboards.
CERT/CC warns of CVE-2025-3927 in Digigram PYKO-OUT AoIP device, where default no-password access allows attackers to control devices and pivot networks.
A large-scale supply chain attack has injected backdoors into e-commerce software, potentially affecting 500-1,000 stores. Sansec urges immediate checks.