CVEs 2025-26389 and 2025-26390 let attackers run code as root or gain admin access on Siemens OZW web servers. Patching is strongly advised.

Ivanti patches CVE-2025-22462, a critical CVSS 9.8 auth bypass flaw in Neurons for ITSM. Risk of full admin access. Patch or restrict IIS access now.

Varnish Cache and Enterprise have a vulnerability allowing HTTP request smuggling. This can lead to cache poisoning and WAF bypass. Upgrade now!

Zoom fixes critical CVE-2025-30663 flaw allowing local privilege escalation. Users urged to update Workplace apps and SDKs to version 6.4.0 or newer.

Bitnami Pgpool flaw (CVE-2025-22248) exposes PostgreSQL to unauthenticated access. Update to Pgpool 4.6.0-1 or Helm chart 16.0.0 to fix.

North Korean threat actor TA406 intensifies cyber espionage against Ukraine, using phishing and malware to gather political intelligence.

Siemens RUGGEDCOM devices face CVSS 9.9 command injection flaws. Authenticated users can execute root-level code via web tools. Patch to V2.16.5 now.

Chihuahua Stealer uses stealthy PowerShell loaders, CNG AES-GCM encryption, and .NET memory injection to exfiltrate browser and crypto wallet data.

Earth Ammit’s VENOM and TIDRONE campaigns target Taiwan and South Korea’s drone, military, and satellite sectors via stealthy supply chain attacks.

A critical vulnerability (CVE-2025-4632) in Samsung's MagicINFO Server puts digital signage at risk. Learn how attackers can gain control and what to do

Swan Vector cyber-espionage campaign uses sophisticated malware to target institutions in Japan and Taiwan. Learn how they evade detection and steal data

Two CVEs in TheGem WordPress theme let subscriber-level users upload malicious files and take over sites. Patch to version 5.10.3.1 now.

Horabot malware targets Latin America with fake invoices, hijacking Outlook to spread phishing emails and steal data via stealthy scripting.

A small article that compliments the Introduction to AWS pentesting course by Tyler Ramsbey.

Analyze your target domain completely using these tools

You know why Usable Encryption sounds like Two-Word Pubchline? Let me explain in simpliest way

Wall Street thrives on speed, data, and an intricate web of digital transactions. It’s a high-stakes environment where fortunes are made and lost in microseconds. For years, financial institutions…

Introduction

If you have a small website, do IT for a company, or simply an inquisitive security enthusiast, one thing is certain — you must scan for…

A lightweight MITM tool for monitoring encrypted traffic and detecting threats powered by AI and built in Python

Day 30: Building Your Career in Red Teaming