CISA/NSA exposed BRICKSTORM, a Chinese state-sponsored backdoor targeting VMware vCenter/ESXi and ADFS servers. The self-restarting malware used DoH and nested TLS for 18 months of persistent espionage.

A High-severity flaw (CVE-2025-66566) in lz4-java allows remote attackers to read uninitialized memory (passwords/keys) from recycled buffers during decompression. Update to v1.10.1 immediately.

A Critical (CVSS 9.9) Auth Bypass flaw (CVE-2025-66489) in Cal.com allows attackers to bypass password checks and hijack accounts by supplying any value in the TOTP field. Update to v5.9.8.

WatchGuard patched five flaws in Fireware OS. CVE-2025-11838 (CVSS 8.7) allows unauthenticated VPN DoS, while CLI Command Injection risks RCE in the management interface. Update immediately to v2025.1.3.

FortiGuard exposed UDPGangster, a custom UDP backdoor deployed by MuddyWater APT. The malware evades network defenses and analysis by using UDP for C2 and checking for single-core CPUs/low RAM.

Google exposed Intellexa (Predator spyware vendor) using 15 zero-days since 2021, including the iOS "smack" exploit chain (JSKit). Google is issuing mass warnings to targeted users globally.

A Critical DoS flaw (CVE-2025-66418) in urllib3 allows malicious servers to crash client apps via an unbounded decompression chain. A streaming flaw also risks memory exhaustion. Update to v2.6.0.

A new ValleyRAT campaign targets English job seekers. The malware uses DLL sideloading via a trojanized Foxit PDF Reader executable to run a Remote Access Trojan and exfiltrate data.

“Engineering an Intelligent Python Framework to Defeat Modern Firewalls”

A Fast, Practical Checklist for Busy Engineers

A Practical, Actionable Guide for SMEs in Southeast Asia

📁 THREAT INTELLIGENCE REPORT: “Zip-Lure” Campaign via WhatsApp

Football is life, connecting millions from all over the globe in a sport that binds fans in love and rivals in hate, but in the throes of…

This write-up documents solving a “Basic Pentesting” style web application CTF by combining classic enumeration techniques with a bit of…

Did you know that thousands of shady companies, known as data brokers, are collecting every detail about your life—from your purchase…

A new strain of Android malware is drawing attention for how easily it can slip into a device and take control of mobile banking activity…

Virtual kidnapping scams are rising because criminals know how to use fear, speed, and digital manipulation to overwhelm good judgment…

✔️ Computers  ✔️ Policies  ✔️ Delegations  ✔️ Service accounts  ✔️ GMSA  ✔️ Trusts  ✔️ Password policy  ✔️ ACLs  ✔️ Kerberos settings

Use standards, not black-box SDKs, to give your apps and CLIs clean, secure single sign-on.

An international fraud operation has culminated in a sweeping blow against a vast crypto-scam network that laundered more