A critical zero-click flaw in WhatsApp (CVE-2025-55177), paired with an Apple zero-day, was used in sophisticated attacks. All users must update now.

Hikvision has issued an advisory for three flaws in its HikCentral products. The most severe, with a CVSS of 8.6, allows an unauthenticated user to get admin access.

ImageMagick has a format string bug (CVE-2025-55298) that can lead to RCE. A PoC is public, and an urgent patch is available for versions 7.1.2-2 and 6.9.13-28.

A new report from AhnLab reveals the Interlock ransomware group is actively attacking businesses and critical infrastructure in North America and Europe with a sophisticated encryption model.

The DOJ has indicted 28 members of a Chinese fraud ring for a $65M scheme targeting seniors. Evidence from YouTubers 'Scammer Payback' helped in the takedown.

Google is investing $9 billion in Virginia by 2026 to expand its cloud and AI infrastructure. The plan includes a new data center and free AI access for college students.

NVIDIA's CFO has stated the company will not pay the U.S. government a 15% revenue share on China sales unless the agreement is formally codified into law.

Xbox Cloud Gaming is now being tested for Game Pass Core and Standard subscribers. The expansion brings the feature to a wider audience beyond the premium Ultimate tier.

Apple has reportedly secured nearly half of TSMC's 2nm chip production for the iPhone 18's A20 processor, a move that highlights the fierce competition for cutting-edge silicon.

D-Link warns of a critical command injection flaw (CVSS 9.8) in its EOL DIR-series routers. A PoC is public, and since no patch is available, devices must be replaced.

A critical zero-day (CVE-2025-57819) in FreePBX with a CVSS 10.0 score is being actively exploited. The flaw allows unauthenticated RCE, and admins must patch immediately.

A critical SQL injection flaw (CVE-2025-50979) in NodeBB allows remote attackers to access sensitive data. Admins are urged to patch immediately.

A new report links Sinobi Group ransomware to Lynx, a potential rebrand. The group is using strong encryption and targeting compromised SonicWall VPN credentials to gain access.

A new Anthropic report reveals how criminals are weaponizing AI systems to automate attacks, create AI-generated ransomware, and secure fraudulent employment.

A new Microsoft report reveals that the Storm-0501 threat actor is pivoting to cloud-native ransomware, using cloud tools to exfiltrate and destroy data without malware.

A new campaign is using fake AI-themed content to trick users into downloading a malicious ScreenConnect installer that secretly delivers the XWorm Remote Access Trojan.

What is the main purpose of a Content Management System (CMS)?

We have to accept that when we ask such existential and philosophical questions, we’re also admitting that we have no idea and that there probably isn’t an easy answer (this is our excuse, and…

On July 18, 2025, users of CrushFTP woke up to an announcement:

As we’ve all experienced in 2025, 2025 has been the year of vendors burying their heads in the sand with regard to in-the-wild exploitation, even in the face of impressively indisputable evidence…

Organizations tend to focus a significant amount of their efforts on external threats, such as phishing and ransomware, but they often overlook one of the most dangerous attack vectors on their internal networks. 

Discover how attackers abuse clipboard paste handling to trigger Blind XSS from setup to exploitation

Learn how to solve Intigriti's 0825 CTF challenge by exploiting an SSRF in Next.js Middleware and leveraging it into a remote code execution. Read the article now!