The High Price of “Free”: Inside the Dark World of Online Carding

TLDR: Foothold — redis 5.0.9 public exploit; Privesc — NIL

By Aditiya Widodo Putra, Cybersecurity & Blockchain Consultant

When we think about cyberattacks, most people imagine firewalls being smashed, ransomware locking up screens, or phishing emails tricking…

My Vision for Secure Web3: Drosera Network

Cloud security and SASE vendor Netskope filed to go public on Nasdaq as NTSK. The filing highlights $707M ARR (+33% YoY), 118% net…

Introduction

Gone are the days of badly spelled pleas from a prince. The new wave of scams is personalized, persuasive, and written by a machine. Your…

Guía práctica para la instalación, configuración y ejecución de escaneos de seguridad con Tenable Nessus en entornos Docker

Introduction

As the demand for cybersecurity professionals continues to rise, many veterans are exploring opportunities in this dynamic field. Their…

Microsoft's September Patch Tuesday addresses 86 flaws, including two zero-days and nine critical vulnerabilities in Windows, Office, Hyper-V, and Azure.

Google has released Chrome 140, patching two vulnerabilities including a critical use-after-free flaw in ServiceWorker and a high-severity flaw in Mojo.

Siemens has disclosed a critical flaw in its SIVaaS platform. A network share is exposed without authentication, allowing unauthenticated attackers to access or alter sensitive data.

A new AI scam network is targeting Indian social media users. It uses deepfakes of celebrities and fake news sites to promote fraudulent investment schemes.

CERT/CC warns of critical flaws in the Hiawatha web server. The vulnerabilities could allow attackers to bypass authentication and hijack sessions.

A new report reveals GONEPOSTAL, a backdoor by Russia's APT28 that hides in Outlook macros and uses email itself as a covert command-and-control channel for espionage.

The Lazarus Group is using a new campaign to steal crypto by exploiting a vulnerability (CVE-2025-48384) with fake interviews and poisoned code repositories.

A new malware strain is targeting exposed Docker APIs, evolving from a cryptominer into a stealthy botnet that blocks ports to "own" a victim's system for exclusive use.