Arctic Wolf reports the first confirmed intrusions into customer networks in which attackers logged into FortiGate devices via

French law enforcement authorities have arrested a 22-year-old man suspected of orchestrating a recent cyberattack against the country’s

Researchers at iVerify have identified a new Android remote access trojan dubbed Cellik, which blends the capabilities of

The Kimwolf botnet has drawn intense scrutiny after researchers at QiAnXin XLab reported that it had infected more

Since early December 2025, SOC teams in Japan have been observing a wave of attacks exploiting React2Shell (CVE-2025-55182)—a

Linux logs its first Rust CVE (CVE-2025-68260): a race condition in the Android Binder driver causing kernel crashes. Fixed in 6.18.1 and 6.19-rc1.

Elastic patches a High-severity XSS flaw (CVE-2025-68385) in Kibana. Attackers can weaponize Vega visualizations to hijack sessions. Update now!

A new Log4j flaw (CVE-2025-68161) breaks TLS hostname verification, allowing Man-in-the-Middle attacks on log data. Upgrade to v2.25.3 now.

WatchGuard warns of an active CVSS 9.3 zero-day (CVE-2025-14733). Attackers are exploiting IKEv2 VPNs for root RCE. Patch and rotate secrets now!

A Headlamp flaw allows unauthenticated users to reuse cached credentials to hijack Kubernetes Helm operations. Update to v0.39.0!

A High-severity flaw (CVE-2025-14558) in FreeBSD allows Remote Code Execution via malicious IPv6 router advertisements and unquoted shell inputs.

Roundcube patches two High-severity flaws: an SVG-based XSS and a CSS sanitizer bypass. Protect your inbox—update to v1.6.12 or v1.5.12 now.

Check Point Research exposes the YouTube Ghost Network, using GachiLoader to spread Rhadamanthys infostealer through cracked software and game cheats.

ReversingLabs uncovered Nethereum.All, a malicious NuGet package with 10M+ fake downloads designed to drain crypto wallets and steal API secrets.

A critical UEFI flaw in ASRock, ASUS, and MSI motherboards fails to enable IOMMU, allowing pre-boot memory access via PCIe devices.

Jolly Scorpius has upgraded its Mario ransomware with multi-layered, dual-key encryption and dynamic chunking to bypass recovery and lock down data.

Phantom v3.5 info-stealer targets passwords and crypto via a fake Adobe installer. It uses SMTP to exfiltrate data directly to attackers.

Starting in 2029, the Oscars move exclusively to YouTube, ending a 50-year run on ABC to reach a global, digital-first audience.

Security firm KOI warns: Urban VPN extensions are secretly harvesting full AI chat transcripts for data brokers. Uninstall immediately to protect your data.

Google’s Gemini 3 Flash defies logic: an ultra-efficient model scoring 81.2% on MMMU-Pro, outperforming OpenAI’s flagship GPT-5.2 in multimodal reasoning.

Understanding React2Shell: A Critical Vulnerability in React Server Components (CVE-2025–55182) Introduction In the rapidly evolving landscape of web development, React has established itself as a …