A zero-day privilege escalation vulnerability (CVE-2025-29824) in Microsoft CLFS was exploited by Balloonfly (Play ransomware) before the official patch.

CISA warns that basic cyber attacks are targeting ICS/SCADA systems in the U.S. energy and transportation sectors due to poor cyber hygiene and exposed assets.

Microsoft announces new AI-powered features for "Copilot+ PC," including natural language settings search and the "Click to Do" function, enhancing Windows 11.

A critical vulnerability in Kibana (CVE-2025-25014) enables arbitrary code execution via prototype pollution. Elastic urges users to patch immediately.

Akamai uncovers active exploitation of retired GeoVision IoT devices via CVE-2024-6047 and CVE-2024-11120 using Mirai-based botnet LZRD.

CVE-2025-46728 in cpp-httplib allows memory exhaustion via chunked requests. Patch to v0.20.1 to prevent denial-of-service attacks.

CVE-2025-47241 in Browser Use lets attackers bypass whitelists via crafted URLs. Upgrade to v0.1.45 to secure AI-driven browser automation.

The CoGUI phishing kit uses advanced evasion to target Japan with high-volume campaigns impersonating Amazon, PayPay, and more.

OpenCTI flaw CVE-2025-24977 allows RCE and secret exposure via webhooks. Patch to v6.4.11 to protect Docker/Kubernetes deployments.

UNC3944 resurfaces as Scattered Spider, linked to DragonForce and RansomHub in new retail attacks. Mandiant warns of social engineering escalation.

CYFIRMA's analysis details Gunra Ransomware's sophisticated techniques, including evasion and data exfiltration, impacting global industries.

Critical security vulnerability (CVE-2025-4318) in AWS Amplify Studio allows arbitrary code execution. Upgrade to version 2.20.3 immediately!

Resecurity exposes Panda Shop smishing kit linked to Chinese cybercrime, targeting millions via iMessage and RCS with carding and data theft.

Research reveals the widely used open source library 'easyjson' is controlled by developers linked to Russia's VK Group, raising security concerns.

It’s… another week, and another vendor who is apparently experienced with ransomware gangs but yet struggles with email.

In what we've seen others term "the watchTowr treatment", we are once again (surprise, surprise) disclosing vulnerability research that…

In this article, I explained how to setup and use (GitHub CodeSpaces) for bug hunting

From Invalid Reports to Real Vulnerabilities: The Path to Growth in Hacking

Hacking the Frontend Logic: Exploiting JavaScript Business Flaws 💼

Automate open redirection detection, save hours of manual testing, and level up your bug bounty recon game.

Today, I’m excited to share how I found an open redirect vulnerability by manipulating the Referer header on a bug bounty program. In this article, I’ll walk you through: An open redirect happens…

Two-factor authentication (2FA) is widely seen as one of the best ways to secure user accounts. Whether it’s through SMS codes, authenticator apps, or hardware tokens, 2FA is meant to protect users…