Cyble uncovers RedHook, a new Android banking trojan targeting Vietnamese users with sophisticated phishing, remote access, screen capture, and keylogging for full device takeover.

A critical vulnerability (CVE-2025-54419, CVSS 10.0) in Node-SAML allows attackers to bypass SAML 2.0 authentication by manipulating unsigned assertion data.

Netskope uncovers XWorm 6.0, a new variant using VBScript droppers, AMSI bypass, and critical process marking to evade detection and force system reboots if terminated.

A new stealthy campaign uses Windows LNK files to deploy the REMCOS backdoor via multi-stage PowerShell commands, bypassing antivirus and gaining full system control.

PyPI warns of a new phishing campaign using "pypj.org" to spoof its login page, tricking maintainers into revealing credentials. PyPI itself is not compromised.

In a deep-dive into the infrastructure powering some of today’s most prevalent malware campaigns, security researcher Vasilis Orlof uncovers a suspected bulletproof hosting provider operating unde…

Elon Musk confirms a $16.5B, nine-year deal with Samsung for AI6 chip production at its Texas foundry, a crucial win for Samsung's struggling chip business and Tesla's AI future.

Neuralink has joined an AI-powered "Smart Bionic Eye" research initiative led by UCSB, aiming to restore sight to the blind by integrating brain-computer interface technology.

An EU open-source Android age verification app is sparking controversy due to its reliance on Google Play Integrity API, raising concerns over digital sovereignty and excluding users with custom ROMs.

A critical command injection flaw (CVE-2025-54418, CVSS 9.8) in CodeIgniter's ImageMagick handler allows remote code execution via malicious filenames or text.

Debian Linux is proactively addressing the Year 2038 Problem by adopting a 64-bit time_t format on 32-bit architectures, preparing for the timestamp overflow set to impact legacy systems globally.

Allianz Life confirms a data breach impacting over 1.4 million individuals after attackers used social engineering to access a cloud-based CRM system. ShinyHunters is suspected.

vivo launches BlueOS, a new open-source OS kernel written in Rust, emphasizing security, minimalism, and broad support for Arm and RISC-V architectures in various terminal devices.

The women-only dating app, Tea, suffered a data breach, leaking 72,000 images, including 13,000 selfies and ID documents, from users who registered before February 2024.

Microsoft has fully resolved Windows 11 24H2 compatibility issues with Easy Anti-Cheat, lifting the update block. Gamers can now upgrade without crashes.

In the DeFi world, even the smallest vulnerability can trigger millions in losses. Just recently, Hydration awarded a $500,000 whitehat…

Burp Suite is the Swiss Army knife for web application penetration testers. Whether you’re just stepping into ethical hacking or prepping…

Join me as I tackle the eJPT one topic at a time. CTF 1 Host and Network Penetration Testing: Exploitation.

Critical vulnerabilities have been discovered in Salesforce’s Tableau platform that could allow attackers to execute arbitrary code…

Why your database choice could be the difference between security and catastrophe

Imagine your office building has a secret side door. It was built for emergencies, but no one really uses it. One day, you forget to lock…