Do Son High-severity BIND 9 flaw CVE-2025-13878 allows remote server crashes via single packet. Update to v9.18.44 or v9.20.18 immediately to prevent DoS.
network-security
Akamai reveals critical Vivotek camera flaw CVE-2026-22755. Unauthenticated command injection allows root access. Update legacy firmware now.
Open5GS WebUI vulnerability CVE-2026-0622 uses the default secret "change-me," allowing attackers to forge admin tokens. Patch now or update your keys.
Critical Alert: Browan PrismX MX100 has hard-coded credentials (CVE-2026-1221, CVSS 9.8). Attackers can access DBs remotely. Update to 1.03.23.01.
RondoDox botnet targets HPE OneView with 40k attacks in 4 hours. Critical RCE CVE-2025-37164 allows full system takeover. Patch immediately.
Palo Alto warns: CVE-2026-0227 forces GlobalProtect firewalls into maintenance mode. Unauthenticated DoS risk. Update PAN-OS immediately.
Critical HPE Instant On update fixes DoS flaw CVE-2025-37166 that forces hard resets. Firmware 3.3.2.0 also stops config leaks. Check your version now.
Critical Aruba AOS flaw CVE-2025-37168 (CVSS 8.2) allows unauthenticated file deletion & DoS. Multiple RCE bugs also patched. Upgrade AOS immediately.
Progress patches high-severity RCE flaws (CVE-2025-13444/47) in LoadMaster & MOVEit WAF. Update UI/API endpoints immediately to prevent command injection.
Critical Apache Uniffle flaw CVE-2025-68637 (CVSS 9.1) exposes Big Data clusters to MITM attacks. Update to v0.10.0 immediately to secure traffic.
Cloudflare debunks claims that Venezuela's CANTV BGP leak was a US military op, attributing the incident to chronic technical errors and misconfigurations.
wolfSSH 1.4.22 patches critical flaw CVE-2025-14942 (CVSS 9.4). The bug allows attackers to bypass authentication and steal passwords. Update immediately.
D4mianWayne details CVE-2025-68615, a 9.8 critical flaw in Net-SNMP allowing unauthenticated RCE. Update to v5.9.5 or v5.10.pre2 now!
Fortinet warns of active exploits for CVE-2020-12812, where attackers bypass 2FA on FortiGate firewalls by simply changing username capitalization.
Log4j’s Security Blind Spot: New TLS Flaw Lets Attackers Intercept Sensitive Logs Despite Encryption
Log4j’s Security Blind Spot: New TLS Flaw Lets Attackers Intercept Sensitive Logs Despite Encryption
A new Log4j flaw (CVE-2025-68161) breaks TLS hostname verification, allowing Man-in-the-Middle attacks on log data. Upgrade to v2.25.3 now.
WatchGuard warns of an active CVSS 9.3 zero-day (CVE-2025-14733). Attackers are exploiting IKEv2 VPNs for root RCE. Patch and rotate secrets now!
The Tor Project is developing the Counter Galois Onion (CGO) algorithm to replace the vulnerable Tor1 protocol, enhancing security against tagging attacks and key reuse.
SonicWall reports a pre-auth stack-based buffer overflow flaw (CVE-2025-40601) in SonicOS SSLVPN, allowing remote DoS attacks. Patches and mitigation are available.
A Critical (CVSS 9.8) flaw (CVE-2025-59396) in WatchGuard Firebox allows unauthenticated remote root access via SSH on port 4118 using default credentials (admin:readwrite). Patch immediately.
TP-Link patched four critical RCE/command injection flaws in its Omada gateways. CVE-2025-6542 (CVSS 9.3) allows unauthenticated remote OS command execution. Update firmware immediately.
Mozilla is developing a new, browser-only Firefox VPN feature, similar to IP Protection, that will encrypt in-browser traffic and conceal the user's IP address as a premium subscription service.
Cisco disclosed a Critical RCE flaw in its Firewall ASA/FTD, IOS, IOS XE, and IOS XR web services. Unauthenticated attackers can gain root access.