“They patched everything… but the breach still happened.”  I’ve heard that sentence too many times in war rooms across the globe.

Challenge Link: JinjaCare — HTB

CISA issues an urgent alert: PaperCut NG and MF are vulnerable to CVE-2023-2533 (CSRF), allowing remote code execution if an admin clicks a malicious link.

The women-only Tea dating app suffers a second, more severe data breach, exposing over 1.1 million private messages, including sensitive discussions on abortions and infidelity.

Dropbox Passwords will be fully discontinued on October 28, 2025. Users must export all saved data before then, as all information will be permanently deleted.

OneNote Insiders are getting new features: cell merging for tables (Windows, Mac, iPad) and a "paste text only" option (Ctrl+Shift+V) for cleaner note-taking.

Google NotebookLM introduces "Video Overviews," an AI-powered feature that turns complex documents into narrated, slide-style videos for enhanced visual learning and presentations.

OpenAI launches "Study Mode" for ChatGPT, an AI feature designed to guide students through problem-solving with a Socratic method, aiming to foster deeper learning rather than just providing answers.

A critical SSRF vulnerability (CVE-2025-54381) in BentoML's file upload handling allows unauthenticated remote attackers to perform internal network reconnaissance and steal cloud metadata credentials from AI applications.

A joint advisory from US, UK, Canada, and Australia warns of Scattered Spider's evolving tactics, now using DragonForce ransomware, spearphishing, SIM swapping, and MFA fatigue to compromise systems.

Wiz Research uncovered a critical flaw in Wix's new AI platform, Base44, that allowed unauthorized access to private enterprise applications and sensitive data by bypassing SSO.

A critical RCE flaw (CVE-2025-5394, CVSS 9.8) in the Alone WordPress theme allows unauthenticated attackers to upload arbitrary files and gain full site control. Exploitation is confirmed in the wild.

Trend Micro reports Gunra ransomware has expanded to Linux, employing 100 parallel encryption threads, partial encryption, and stealthy keystore methods to target global enterprises.

Seychelles Commercial Bank (SCB) suffered a cyberattack exposing 1.4M+ customer PII, including government employee data. Resecurity suspects espionage, not just financial gain, given the low data sale price.

The EOL TP-Link Archer C50 router has a critical hardcoded DES key (CVE-2025-6982), allowing attackers to decrypt sensitive configuration files, including admin credentials and Wi-Fi passwords.

Trellix uncovers 0bj3ctivityStealer, a sophisticated info-stealer using phishing, custom PowerShell, and steganography to evade detection and exfiltrate sensitive data.

BeyondTrust patches two high-severity LPE flaws (CVE-2025-2297, CVE-2025-6250) in Privilege Management for Windows, allowing local attackers to gain SYSTEM privileges via user profile manipulation and WMIC exploit.

A recent in-depth analysis from Cyfirma has shed light on the alarming capabilities of Raven Stealer, a lightweight yet powerful information-stealing malware rapidly gaining traction across the cy…

Cloudflare’s Turnstile CAPTCHA feature is designed to automate verification and reduce friction caused by traditional image selection or click-based challenges. In theory, this mechanism should se…

SonicWall discloses CVE-2025-40600, a critical format string vulnerability in SonicOS SSL VPN, allowing unauthenticated remote DoS attacks on Gen7 firewalls. Update to 7.3.0-7012 or later.

Windows 11 Beta and Dev builds now show image search results with visual previews directly in the search box, based on local index data, for a more intuitive experience.