Do Son NGINX's new ACME module automates SSL/TLS certificate management, allowing users to request and renew certificates directly from the NGINX configuration.
Web Security
Sucuri uncovers a stealthy WordPress malware plugin that mimics your domain to inject SEO spam for bots while remaining invisible to users, evading detection.
Cloudflare launched an AI Crawler Leaderboard ranking AI company web crawlers. ByteDance is last for ignoring robots.txt and lack of IP transparency, prompting new blocking defaults.
Sucuri uncovers a complex multi-stage malware campaign infecting WordPress sites via header.php to deliver a hidden RAT (client32.exe) and evade detection.
A rogue WordPress plugin is distributing multi-functional malware, performing credit card skimming, credential theft, ad fraud, and RCE through advanced evasion tactics.
A critical flaw (CVE-2025-4322) in the WordPress Motors theme allows unauthenticated attackers to reset passwords for full site takeover.
A critical SSRF flaw (CVE-2025-6087) in @opennextjs/cloudflare allows unauthenticated users to proxy arbitrary remote content via /_next/image endpoint.
GreyNoise reports a massive brute-force campaign targeting Apache Tomcat Manager interfaces, with hundreds of malicious IPs attempting to compromise services.
A medium-severity flaw (CVE-2025-41234) in Spring Framework allows Reflected File Download (RFD) attacks. Update to 6.2.8, 6.1.21, or 6.0.29 immediately
A high-severity flaw (CVE-2024-43706) in Kibana's Synthetic Monitoring allows unauthorized access. Upgrade to 8.12.1 or apply mitigations immediately.
A critical RLS vulnerability (CVSS 9.3) in the Lovable low-code platform exposes sensitive user data and allows unauthorized modification.
A critical 9.8 CVSS vulnerability in PayU CommercePro for WordPress allows unauthenticated admin account takeover. No patch available, immediate removal advised.
A critical Auth0 PHP SDK deserialization flaw (CVE-2025-48951, CVSS 9.3) allows unauthenticated RCE in web apps. Patch to v8.14.0+ immediately!
A new DoS vulnerability (CVE-2025-48866) found in ModSecurity WAF can crash your web application. Update to 2.9.10 immediately!
Critical Chrome security update released! Patching an actively exploited zero-day vulnerability (CVE-2025-5419) and other flaws. Update now to stay safe!
A critical flaw in Fabio load balancer allows malicious clients to manipulate or strip HTTP headers, leading to potential access control bypass. Upgrade to 1.6.6.
New CrossPUSH & CrossSXG attacks exploit HTTP/2 and SXG to bypass Same-Origin Policy, enabling XSS and cookie manipulation.
A Varnish Cache flaw lets attackers smuggle HTTP requests and poison cached responses. Update to the patched release right away.
React Router flaws CVE-2025-43864 and CVE-2025-43865 allow cache poisoning and data spoofing attacks; users must upgrade to version 7.5.2 or later.
A CVE-2025-43859 vulnerability in Python’s h11 library may lead to request smuggling attacks when paired with buggy proxies. Patch to version 0.15.0 now.
Craft CMS patches critical CVE-2025-32432 flaw. Exploited in the wild—users must update to versions 3.9.15, 4.14.15, or 5.6.17.
Apache Roller has a security vulnerability (CVE-2025-24859) where sessions aren't invalidated after password changes, risking unauthorized access