Three critical MariaDB server vulnerabilities, including a CVSS 10 flaw, allow attackers to execute shell commands. Patch your database servers immediately.

Mitel patched 12 critical MiCollab vulnerabilities, several at CVSS 10.0. Unauthenticated command injection and SQL injection flaws need urgent updates.

ESET found vendor-signed UEFI applications vulnerable to a Secure Boot bypass. Attackers can run pre-boot code. Update firmware and the UEFI DBX now.

Two critical HAProxy vulnerabilities threaten reverse-proxy security. These flaws allow denial of service and smuggling attacks. Patch servers immediately.

What are CSRFs ?

Introduction

At a Glance Field Detail Malware family Prinz Eugen (Go-based ransomware, .prinzeugen extension) Threat actor Prinz Eugen group; linked to the operator handle ROOTBOY (suspected) Victims At least …

Malware Family: AryStinger Threat Actor: Unknown (Suspected) Victims: Over 4,000 legacy D-Link routers and NAS systems Delivery Vector: Exploitation of older CVEs Key Capabilities: Traffic proxyin…

India’s Tata Group has confirmed to Reuters that it recently suffered a cyberattack. Hackers claim they stole confidential Apple and Tesla documents from the company. Tata Electronics provid…

Apple confirms the AirPort Utility app is going away soon. Discover how the AirPort Utility deprecated status affects legacy Wi-Fi router management.

iOS 27 Developer Beta 2 brings Write with Siri on the keyboard, RCS inline replies, Wallet Insights, and an iPhone Mirroring fix.

Discover how the latest v0.142.0 update fixes the severe Codex SSD wear issue. Learn about the log optimization and how it protects your local database.

Three critical Tinyproxy request smuggling vulnerabilities, including CVE-2026-54388, expose networks to severe attacks. Update your proxy servers immediately.

There is a link on a lot of cybersecurity resumes that nobody thinks twice about. A GitHub link, sitting right under the name, added…

Level: Medium

I recently completed the CloudGoat sns_secrets scenario, a deliberately vulnerable AWS environment designed to simulate real-world cloud…

Sometimes a leak starts not with a hacked admin panel, but with an open service request. Attackers are using exactly that method against WordPress sites that run the Gravity SMTP plugin. The vulne…

Google's Android developer verification starts enforcing on Sept 30, 2026. See the full timeline, the 24-hour sideload flow, and the ADB exemption.

Peace be upon you readers… 👋

Challenge: Intigriti 0626 — Inside Job Target: https://challenge-0626.intigriti.io Vulnerability: Blind XSS / HTML injection under a strict…