CYFIRMA warns of a new Android malware campaign disguised as banking apps, aggressively targeting Indian bank customers to steal credentials, intercept OTPs, and perform unauthorized transactions.

ropr is a blazing fast multithreaded ROP Gadget finder. These gadgets may be used for binary exploitation and to subvert vulnerable executables.

CastleLoader, a sophisticated malware loader, is actively exploiting ClickFix phishing and fake GitHub repos to distribute infostealers and RATs, with a 29% infection rate.

TerraformGoat is HuoCorp research lab's "Vulnerable by Design" multi cloud deployment tool. supported cloud vendors include AWS, Azure, Google

A critical command injection flaw (CVE-2025-54416) in tj-actions/branch-names GitHub Action allows arbitrary code execution in workflows, affecting over 5,000 public repositories.

Unit 42 reveals homograph phishing attacks exploiting visually similar characters to bypass defenses and deceive users. AI is amplifying this threat, making malicious emails highly convincing.

Sygnia uncovers "Fire Ant," a sophisticated cyber-espionage campaign exploiting VMware ESXi and vCenter since early 2025, using advanced techniques to evade detection and maintain persistent access.

Salesforce patched eight critical flaws in Tableau Server, including RCE, database exposure, and SSRF vulnerabilities, urging users to update immediately.

eSentire unveils Cyber Stealer, a new infostealer-botnet hybrid offered as a service, fusing data theft, remote control, crypto mining, and DDoS attacks into one scalable toolkit.

Hybrid Analysis reveals SHUYAL, a new stealthy infostealer that harvests browser credentials, system data, and screenshots, exfiltrating it all via a Telegram bot.

Cisco Talos reveals "Chaos," a new RaaS operation likely formed by former BlackSuit members, using vishing and Quick Assist to conduct big-game hunting and double extortion campaigns.

A critical privilege escalation flaw (CVE-2025-6241) in Lakeside Software's SysTrack allows low-privileged local users to gain SYSTEM access via DLL hijacking. Patch immediately.

A critical flaw (CVE-2025-54369) in Node-SAML allows attackers to bypass SAML 2.0 authentication by manipulating unsigned assertion data. Update to v5.1.0 immediately!

OT-ISAC warns that China-linked APT group UNC3886 is actively targeting Singapore's critical infrastructure, exploiting zero-day vulnerabilities for stealthy, long-term access.

IBM X-Force warns that Russian-aligned Hive0156 is intensifying spear-phishing campaigns against Ukrainian government and military, delivering Remcos RAT via LNK/PowerShell files.

Microsoft is replacing its MSN News feed in Windows 11's widgets panel with "Copilot Discover," an AI-driven experience offering personalized content and smoother interactions.

Apple introduces more granular age ratings for the App Store, enhancing family safety tools and requiring developers to complete new content questionnaires by Jan 2026.

Intel's new CEO indicates the company may exit advanced chip manufacturing (14A/18A) if external demand falters, highlighting struggles to compete with TSMC and ongoing cost-cutting efforts.

Google introduces "Opal" in Google Labs, an experimental AI service allowing users to build web applications using natural language prompts, simplifying app creation for non-technical users.

“Give me your JavaScript, and I’ll give you your bug bounty.”

“The JavaScript files told me everything — I just had to listen.”