CISA added CVE-2025-25257, a critical FortiWeb SQL injection vulnerability (CVSS 9.6), to its KEV Catalog, confirming active exploitation in the wild. Update immediately!

CrushFTP has issued an urgent advisory for CVE-2025-54309, a critical zero-day allowing remote exploitation via HTTP(S), already being actively used in the wild.

NetSPI uncovered CVE-2025-4660 in Forescout SecureConnector, allowing unauthenticated attackers to hijack endpoints remotely via a misconfigured named pipe.

A new ransomware, KAWA4096, combines features from Qilin and Akira, targeting organizations in the US and Japan with multi-threaded encryption and anti-recovery measures.

Nvidia released patches for critical vulnerabilities (CVE-2025-23270, CVE-2025-23269) in Jetson Linux and IGX, allowing RCE, data tampering, and info disclosure.

Microsoft's Startup Boost preloads 365 apps for faster launch. Initially default on some Win 11 versions, it now appears disabled. Check your Task Scheduler!

Paying Claude Code subscribers, especially on the Max plan, are encountering unexpected usage limits, sparking frustration over Anthropic's vague pricing and lack of communication.

OpenAI launches ChatGPT Agent for Pro, Plus, and Team users, transforming the AI into an active executor capable of planning, generating, and running complex tasks.

Amazon's 2024 sustainability report reveals a 6% rise in carbon emissions, primarily driven by massive AI data center expansion, challenging its Climate Pledge goals.

Mark Zuckerberg and other Meta executives have settled an $8 billion shareholder lawsuit linked to repeated privacy violations from the 2018 Cambridge Analytica scandal.

Google is suing the operators of BadBox 2.0, one of the world's largest smart TV botnets, to combat digital fraud and protect over 10 million infected Android devices.

Grafana Labs issued urgent patches for high-severity XSS (CVE-2025-6023) and medium-severity open redirect (CVE-2025-6197) vulnerabilities, impacting its observability platform.

Cisco Talos uncovers a sophisticated MaaS operation leveraging public GitHub repos and the Emmenhtal loader to distribute Amadey, SmokeLoader, and AsyncRAT, often via phishing.

Ubiquiti warns of CVE-2025-27212, a critical (CVSS 9.8) command injection vulnerability in UniFi Access devices, enabling unauthenticated RCE on the management network.

Kaspersky Labs reveals GhostContainer, a sophisticated backdoor targeting Microsoft Exchange infrastructure in Asia's government and high-tech sectors, using advanced evasion tactics.

A critical RCE (CVE-2025-34300, CVSS 10.0) in Lighthouse Studio's Perl CGI scripts allows unauthenticated attackers to execute arbitrary code on web servers hosting surveys.

Lookout Threat Lab reveals Massistant, a powerful new mobile forensics app from China's Meiya Pico, used by law enforcement to extract vast user data from seized phones.

Jamf Threat Labs has uncovered a sophisticated new macOS infostealer variant that managed to bypass Apple’s security defenses by leveraging valid code signing and notarization

📌Free Article Link.

What started as a path traversal led to XSS, SSRF, and full account compromise.

Free Link 🎈