CISA warns of active exploitation of a SimpleHelp RMM flaw (CVE-2024-57727) by ransomware actors, impacting utility billing software providers and their customers.

A new flaw (CVE-2025-6031) in the discontinued Amazon Cloud Cam allows attackers to intercept network traffic, highlighting risks of unsupported smart home devices.

GreyNoise reports a massive brute-force campaign targeting Apache Tomcat Manager interfaces, with hundreds of malicious IPs attempting to compromise services.

Explore the massive June 12, 2025 global cloud outage that took down Google, Cloudflare, and more. Uncover the ripple effects and lingering questions from this unprecedented digital disruption.

Mitel warns of a critical path traversal flaw (CVSS 9.8) in MiCollab, allowing unauthenticated attackers to access provisioning data and perform admin actions.

Bosch warns of a critical RCE flaw (CVSS 10.0, CVE-2025-29902) in Telex RDC Server and RTS VLink, allowing unauthenticated remote code execution. Patch immediately!

TeamFiltration is being actively exploited in UNK_SneakyStrike, targeting over 80,000 Microsoft Entra ID accounts with password spraying and data exfiltration.

A critical CI/CD flaw in remote caches allows undetectable code injection and privilege escalation via cache poisoning, bypassing all security controls.

A flaw (CVE-2025-49146) in PostgreSQL JDBC Driver allows MITM attacks even with channel binding enabled. Upgrade to v42.7.7 or use sslMode=verify-full.

A high-severity flaw (CVE-2025-4922) in HashiCorp Nomad allows privilege escalation via ACL policy lookup. Upgrade to Nomad 1.10.2 (or later) immediately.

BrowserVenom malware is spreading via fake DeepSeek-R1 Google Ads, installing a proxy implant that hijacks all browser traffic. Beware of fake LLM installers.

HelloTDS is a sophisticated traffic direction system delivering millions to FakeCaptcha and other malware via advanced fingerprinting and evasive tactics.

Hackers Are Earning 💸$XX,000+ With This Secret Trick — Now It’s Your Turn

How to improve your recon and reporting using augmented context with large language models

Exploiting path mapping for web cache deception — a subtle yet powerful technique.

Hey there!😁

A Subtle Enumeration Bug That Let Attackers Harvest Emails Before Invitations Were Accepted — $7,500 Bounty

How Modern APIs Are Giving Hackers a Query Language for Mayhem

JWT Authentication Bypass via Algorithm Confusion Exploit Without Key Disclosure

Security bugs aren’t always flashy. Sometimes, you don’t need to pop a shell or find an RCE to make an impact.
Sometimes… all you need is…

Hello hackers, Welcome to the latest edition of Bug Bytes! In this month’s issue, we’ll be featuring: Becoming an Intigriti Pentester Exploiting CORS in 2025 (even when SameSite is set to ‘Strict’) A...