Three flaws in Frappe Framework allow account takeover via password reset token leaks, XSS via file upload, and SQL injection. Update self-hosted ERPNext immediately!

A report exposes Pakistani freelancers building websites distributing cracked software with stealer malware, leveraging a pay-per-install model and geopolitical loopholes.

CERT@VDE and Pilz disclose critical flaws in IndustrialPI 4: unauthenticated remote bypass (CVSS 9.6) and RCE (CVSS 10.0) via exposed Node-RED. Update or mitigate immediately.

Difficulte : meduim

(Washington, D.C.) — Just two days after two Iranian satellites were knocked offline in a coordinated cyberattack, a notorious hacker…

In late April 2025, Marks & Spencer (M&S), the iconic British retailer with a 141-year legacy, fell victim to a large-scale ransomware…

Tehran, Iran (Reuters-like) — In what appears to be one of the most sophisticated cyberattacks on Iranian aerospace infrastructure to date…

The Phish That Almost Got Away: A Cybersecurity Wake-Up Call

Set up a local agentic AI threat modeling environment

The story of LockBit — a name that once instilled fear in IT departments worldwide — has taken a dramatic turn. Once considered the apex…

Cyberattacks Targeting the Energy Sector

Stealth attacks deploy Go backdoors via AWS/fake sites—zero admin rights, zero alerts, zero detection.

HELLO AWESOME BUYER

Web Application Firewalls (WAFs) have become a cornerstone of modern network and perimeter security. Not only are they a best practice for…

Video: Coming

A critical RCE flaw (CVE-2025-47812, CVSS 10.0) in Wing FTP Server allows unauthenticated attackers to execute arbitrary Lua code via NULL byte injection, compromising the server

A critical flaw (CVE-2025-6463, CVSS 8.8) in Forminator WordPress plugin allows unauthenticated arbitrary file deletion, leading to site takeover.

A Chinese student was jailed in London for running a smishing campaign with an "SMS Blaster" hidden in his car, spoofing texts to steal data.

ANSSI exposes "Houken," a China-linked APT exploiting Ivanti CSA zero-days (CVE-2024-8190, CVE-2024-8963, CVE-2024-9380) and deploying Linux rootkits for cyber-espionage against strategic sectors.

OFAC sanctioned Russia's Aeza Group, a bulletproof hosting provider, and its executives for enabling ransomware, infostealers (Meduza, Lumma), and darknet drug trafficking operations globally.

The DOJ dismantled a North Korean scheme exploiting remote IT jobs at 100+ U.S. firms, using stolen identities and laundering millions to fund DPRK weapons programs.