A critical flaw (CVE-2025-57808) in ESPHome allows an attacker on the local network to bypass authentication entirely, gaining control of smart home devices.

A new report reveals TinkyWinkey, a stealthy Windows keylogger that uses low-level APIs and DLL injection to steal credentials and sensitive data from victims.

Anthropic is launching a web-based version of Claude Code. The new tool allows developers to work on code from any browser, streamlining workflows with cloud-based AI.

OpenAI's Codex gets a major update with a new VS Code extension and local-to-cloud handoff. The update allows for seamless, synced coding tasks from anywhere.

A new report reveals a Lazarus Group subgroup is using a tiered arsenal of custom RATs—PondRAT, ThemeForestRAT, and RemotePE—to target the financial and crypto sectors.

Qualcomm's latest bulletin patches two critical modem flaws (CVE-2025-21483 & CVE-2025-27034) with CVSS 9.8 scores, enabling remote code execution via rogue cellular base stations.

A new report reveals a dangerous misconfiguration: exposed appsettings.json files can contain Azure AD credentials, giving attackers full access to a company's cloud kingdom.

HashiCorp has issued a security advisory for a high-severity DoS flaw (CVE-2025-6203) in Vault. A malicious JSON payload could make a server unresponsive.

Researchers at Seqrite Lab have uncovered a new spear-phishing operation attributed to APT-37 (ScarCruft / InkySquid / Reaper), a North Korean state-backed cyber espionage group. The campaign, dub…

Okta Threat Intelligence is sounding the alarm over a large-scale phishing campaign that has been actively impersonating major players in the hospitality and vacation rental sector. The campaign l…

For over a year, Huntress researchers have been tracking the rise of ClickFix attacks, a form of social engineering that tricks users into executing malicious code by disguising it as a CAPTCHA ve…

A new RAT, disguised as an AI assistant, is using social engineering to infiltrate a role-playing community. The malware provides attackers with full remote control over infected PCs.

A new report reveals a critical flaw in Harness Gitness that allows authenticated attackers to write arbitrary files to the server, risking a full system compromise.

An Iranian-aligned group abused a compromised Omani Foreign Ministry mailbox to send spear-phishing emails to diplomats and international organizations in a global campaign.

A new report reveals a network of Ukrainian and offshore hosting providers are fueling large-scale brute-force and password-spraying campaigns to enable global ransomware attacks.

If you think your password is safe just because it has a capital letter and a number, think again. Password cracking has come a long way —…

When running modern server panels like 1Panel, security should always be a top priority. One common attack vector is SQL Injection, where…

Credential-based compromises are rewriting the rules of cybersecurity. Once considered a secondary risk, stolen or manipulated credentials…

If you’ve ever sat in a SOC, you know the feeling: hundreds of alerts, most of them false positives. It’s like listening to static on the radio and trying to catch one important sentence. · The…

For most of us, a webcam is a simple accessory — a tiny lens perched on top of our screen, quietly doing its job in meetings or casual…