Upgrading my home network was supposed to be easy. All I wanted was to replace my ISP-provided Rogers router with a powerful new TP-Link…

challenge link : https://cyberdefenders.org/blueteam-ctf-challenges/silent-breach/

Make your crypto work for you with ⏃⌰⟟⟒⋏ ⏁⟒☊⊑

A new report details how North Korean hackers, the Lazarus Group, used social engineering to steal $14M from WOO X user accounts in a targeted attack.

A new report from Amnesty International warns that the dominance of Big Tech poses a critical threat to human rights and calls on governments to act now.

Google clarifies that recent claims of a "major Gmail security breach" affecting 2.5 billion users are entirely false and based on misinformation.

A new Linux kernel flaw (CVE-2025-38617) in the af_packet subsystem can cause a kernel panic. A PoC has been released, and admins are urged to update patched kernels.

A critical flaw (CVE-2025-57808) in ESPHome allows an attacker on the local network to bypass authentication entirely, gaining control of smart home devices.

A new report reveals TinkyWinkey, a stealthy Windows keylogger that uses low-level APIs and DLL injection to steal credentials and sensitive data from victims.

Anthropic is launching a web-based version of Claude Code. The new tool allows developers to work on code from any browser, streamlining workflows with cloud-based AI.

OpenAI's Codex gets a major update with a new VS Code extension and local-to-cloud handoff. The update allows for seamless, synced coding tasks from anywhere.

A new report reveals a Lazarus Group subgroup is using a tiered arsenal of custom RATs—PondRAT, ThemeForestRAT, and RemotePE—to target the financial and crypto sectors.

Qualcomm's latest bulletin patches two critical modem flaws (CVE-2025-21483 & CVE-2025-27034) with CVSS 9.8 scores, enabling remote code execution via rogue cellular base stations.

A new report reveals a dangerous misconfiguration: exposed appsettings.json files can contain Azure AD credentials, giving attackers full access to a company's cloud kingdom.

HashiCorp has issued a security advisory for a high-severity DoS flaw (CVE-2025-6203) in Vault. A malicious JSON payload could make a server unresponsive.

Researchers at Seqrite Lab have uncovered a new spear-phishing operation attributed to APT-37 (ScarCruft / InkySquid / Reaper), a North Korean state-backed cyber espionage group. The campaign, dub…

Okta Threat Intelligence is sounding the alarm over a large-scale phishing campaign that has been actively impersonating major players in the hospitality and vacation rental sector. The campaign l…

For over a year, Huntress researchers have been tracking the rise of ClickFix attacks, a form of social engineering that tricks users into executing malicious code by disguising it as a CAPTCHA ve…

A new RAT, disguised as an AI assistant, is using social engineering to infiltrate a role-playing community. The malware provides attackers with full remote control over infected PCs.

A new report reveals a critical flaw in Harness Gitness that allows authenticated attackers to write arbitrary files to the server, risking a full system compromise.

An Iranian-aligned group abused a compromised Omani Foreign Ministry mailbox to send spear-phishing emails to diplomats and international organizations in a global campaign.