Do Son Cisco warns of active exploitation for three critical ISE flaws (CVSS 10.0), allowing unauthenticated RCE and full system control. Update ISE 3.3 and 3.4 immediately!
zero-day
A Windows CLFS zero-day (CVE-2025-29824) actively exploited by RansomEXX and Play ransomware gangs for privilege escalation, with a public PoC. Patch now!
An unauthenticated SharePoint RCE chain dubbed ToolShell (CVE-2025-49704, CVE-2025-49706) is being actively exploited globally, granting attackers full control of on-premise servers.
Microsoft warns of active zero-day exploitation (CVE-2025-53770, CVSS 9.8) in on-premises SharePoint Server. No patch is available, but mitigations are provided.
CrushFTP has issued an urgent advisory for CVE-2025-54309, a critical zero-day allowing remote exploitation via HTTP(S), already being actively used in the wild.
A critical vulnerability was found in Cisco Identity Services Engine (ISE) and Cisco ISE-PIC. Tracked as CVE-2025-20337,...
Google's Big Sleep AI agent successfully identified and neutralized a critical SQLite vulnerability (CVE-2025-6965) before it could be exploited in the wild, marking a new era in AI-powered proactive defense.
Google released a critical Chrome update (138.0.7204.157/.158) patching six vulnerabilities, including CVE-2025-6558, a high-severity zero-day actively exploited in the wild. Update immediately!
Microsoft's July 2025 Patch Tuesday fixes 140 flaws, including a SQL Server zero-day (CVE-2025-49719), multiple RCEs, critical Office/Word bugs, and AMD CPU-level threats.
Chinese national Xu Zewei, linked to HAFNIUM, arrested in Italy for cyberespionage. He targeted US COVID-19 research & exploited Exchange zero-days, compromising 60,000+ US entities for China's MSS.
Microsoft Edge version 138.0.3351.65 fixes two RCE flaws: a V8 zero-day (CVE-2025-6554) actively exploited, and an Edge-specific type confusion (CVE-2025-49713).
Actively Exploited Google Chrome Zero-Day (CVE-2025-6554) Added to CISA’s KEV Catalog, PoC Available
Actively Exploited Google Chrome Zero-Day (CVE-2025-6554) Added to CISA’s KEV Catalog, PoC Available
Google has urgently patched a high-severity zero-day (CVE-2025-6554) in Chrome's V8 JavaScript engine. This type confusion flaw is actively exploited in the wild, risking RCE.
ANSSI exposes "Houken," a China-linked APT exploiting Ivanti CSA zero-days (CVE-2024-8190, CVE-2024-8963, CVE-2024-9380) and deploying Linux rootkits for cyber-espionage against strategic sectors.
Google has urgently patched a high-severity zero-day (CVE-2025-6554) in Chrome's V8 JavaScript engine. This type confusion flaw is actively exploited in the wild, risking RCE.
CISA, FBI, and NSA call for adopting memory-safe languages (Rust, Go, Java, Swift) to slash software vulnerabilities. Android saw a 52% drop in memory bugs after embracing MSLs.
Team46 (TaxOff) is exploiting a Google Chrome sandbox escape zero-day (CVE-2025-2783) to deploy the multi-layered Trinper malware via phishing campaigns
CISA adds two actively exploited zero-days to KEV: an iOS zero-click flaw used by spyware (CVE-2025-43200) and a command injection in TP-Link routers
Zero-day CVE-2025-33073 allows remote privilege escalation to SYSTEM on Windows via SMB. PoC available. Fixed in June 10, 2025 Patch Tuesday.
Stealth Falcon APT is exploiting a Windows WebDAV zero-day (CVE-2025-33053) in a sophisticated cyberespionage campaign targeting defense entities in the Middle East & Africa.
Microsoft's June 2025 Patch Tuesday fixes 69 vulnerabilities, including two exploited zero-days in WebDAV and Windows SMB Client. Patch immediately!
CISA adds 3 actively exploited Qualcomm Adreno GPU flaws to KEV catalog. Android devices at risk from memory corruption and use-after-free bugs.
Kaspersky's Q1 2025 report highlights a surge in attacks on aging systems, unpatched flaws, and mismanaged updates, urging vigilance and prompt action.