CISA added a critical XXE flaw (CVE-2025-58360) in OSGeo GeoServer to the KEV Catalog. The actively exploited bug allows attackers to read arbitrary files and perform SSRF on internal networks. Patch immediately.

A sophisticated cyber weapon previously linked to targeted espionage has gone rogue, flooding the threat landscape after its creation tools were leaked to the public. A new report from Check Point…

A sophisticated phishing campaign uses salary review lures to target M365/Okta SSO. Attackers proxy the login page to preserve customization and hijack critical session tokens via dynamic redirection.

A Critical (CVSS 9.8) flaw in Soledad WordPress Theme allows Subscribers to escalate privileges and gain full site takeover by exploiting an exposed AJAX action. Update to v8.6.9.1 immediately.

A movie torrent scam uses a DiCaprio film lure to infect PCs with Agent Tesla RAT. The attack chain uses LNK files and malicious code hidden in a subtitle file to achieve fileless execution via LotL tools.

GOLD BLADE (RedCurl) targets Canadian firms (80% of attacks) with espionage and QWCrypt ransomware. The group uses fake resumes and a BYOVD EDR killer (Zemana driver) to disable security controls.

Learn about types of XSS vulnerabilities and how to prevent them.

สวัสดีค่ะ วันนี้เราจะมาแชร์วิธีการหา root flag ในกล่อง Explosion ซึ่งเป็นกล่องใน Starting Point - Tier 0 ของ HackTheBox ค่ะ ถ้าพร้อมแล้ว…

SpearSpray is an advanced AD password spraying tool using Kerberos and LDAP, featuring jitter and domain policy awareness to bypass account lockouts for stealthy attacks.

Google has released an unscheduled Chrome update to patch a zero-day vulnerability already being exploited in active attacks.

Microsoft has released its December security updates: Patch Tuesday brings fixes for 57 vulnerabilities, including three zero-days (one

The investigation in Japan has detained two Chinese nationals suspected of orchestrating the largest known market-manipulation scheme involving

Experts at Doctor Web have identified a new click-fraud trojan, Trojan.ChimeraWire, which disguises itself as the activity of

The financially motivated group Storm-0249, long known as a broker of initial access for ransomware operators, has markedly

A newly discovered vulnerability in Node.js, designated CVE-2025-55182 and informally dubbed React2Shell, has become a favored weapon of

The widow of Saudi dissident journalist Jamal Khashoggi has filed a complaint with the French prosecutor’s office, alleging

The International Criminal Court has released a draft policy aimed at confronting crimes committed through digital technologies. The

OpenAI launches GPT-5.2 ("Red Alert") to reclaim the top spot from Gemini 3 Pro. The model achieves perfect math scores and promises unparalleled reliability for enterprise tasks.

Disney invests $1B in OpenAI and licenses 200+ characters (Mickey, Iron Man, Vader) for Sora and ChatGPT Images—a major pivot to defining the rules of AI-generated content.

OpenAI integrates Photoshop, Acrobat, and Adobe Express into ChatGPT via MCP. The move creates an "AI super-app," enabling 800M users to edit images and PDFs directly in chat.