สวัสดีค่ะ วันนี้เราจะมาแชร์วิธีการหา root flag ในกล่อง Fawn ซึ่งเป็นกล่องใน Starting Point - Tier 0 ของ HackTheBox ค่ะ ถ้าพร้อมแล้ว เราก็กด…

With the rapid development of technology and digital transformation, every online activity we do now has real legal consequences. The…

On December 6, a critical security flaw — CVE-2025–66478 — was publicly disclosed, impacting both Next.js and React Server Components…

DllShimmer weaponizes DLL hijacking by cloning the original DLL's Export Address Table (EAT), enabling stealthy backdooring of functions without detection or reverse engineering.

A Notepad++ flaw (now patched in v8.8.9) allowed attackers to hijack the WinGUp update process, serving malware instead of the legitimate executable. Manual update is urged.

After a 16-year legal battle, Intel loses its appeal against the EU's antitrust ruling. The court upheld the "naked restrictions" finding but reduced the final fine to €237 million.

Qualcomm acquires Ventana Micro Systems to integrate high-performance RISC-V expertise, bolstering its custom Oryon CPU roadmap and securing freedom from architectural constraints.

Instagram launches "Your Algorithm" for Reels, allowing users to see and tune their content preferences with keywords—a move toward TikTok-style personalization.

The EU reached a provisional agreement for a sweeping 90% reduction in greenhouse gas emissions by 2040, cementing its global lead despite political and industrial resistance.

An Important DoS flaw (CVE-2025-64775) in Apache Struts 2 risks server crashes. Improper cleanup of multipart request files leads to disk exhaustion. Update to v6.8.0 or v7.1.1 immediately.

Zoom Rooms patched two flaws: a High-severity (CVSS 7.8) LPE flaw in Windows via downgrade bypass and information disclosure in macOS. Update to v6.6.0 immediately to prevent unauthenticated access.

Google has pushed an urgent security update to the Stable Channel for Desktop, racing to patch a high-severity vulnerability that is currently being exploited in the wild. The release, which bring…

Jenkins patched nine flaws: a High-severity unauthenticated DoS (CVE-2025-67635) via HTTP CLI and XSS via Coverage Plugin. Build tokens are now encrypted. Update to v2.541 immediately.

A Gogs zero-day (CVE-2025-8110) bypasses a previous patch, enabling RCE via symlink path traversal. Over 50% of exposed instances are compromised, deploying the Supershell C2. Disable open registration immediately.

A High-severity XSS (CVSS 8.7) flaw in GitLab Wiki allows session hijack via malicious pages, enabling unauthorized actions. Other HTML Injection flaws patched. Self-managed admins must update to v18.6.2.

Meta rolls out a transparent Facebook redesign for better navigation. Meanwhile, Instagram is secretly using AI to generate "content-farm" titles in code to boost Google SEO.

SpaceX is planning a record-shattering IPO in 2026/2027 to raise over $30B, targeting a $1.5T valuation. Proceeds will fund Mars ambitions and orbital AI data centers.

China-nexus WARP PANDA APT targets VMware/Azure with BRICKSTORM, a Golang backdoor using DoH for stealth. The group creates "ghost VMs" and conducts session replay attacks for long-term espionage.

A critical unpatched flaw in the TOTOLINK AX1800 router allows unauthenticated HTTP requests to enable Telnet for root RCE. Admins must block WAN access immediately as there is no official fix.

FBI/CISA warn pro-Russia hacktivists (CARR, NoName057) are targeting critical infrastructure with unsophisticated attacks. They exploit unsecured VNC connections to manipulate HMIs and cause physical damage.

CISA warned of a Critical (CVSS 9.4) flaw in D-Link DCS-F5614-L1 cameras. Missing Authentication allows attackers to bypass login, steal admin credentials, and hijack video feeds. Patch immediately.