Lado 1

Unit 42 disclosed a Critical unauthenticated RCE flaw (CVE-2025-52906) in TOTOLINK X6000R routers, allowing remote attackers to execute arbitrary commands. Update immediately.

Splunk issued patches for six flaws, including a High-severity blind SSRF (CVE-2025-20371) and XSS issues that could allow attackers to access sensitive data and crash the platform.

The Django team released urgent updates (v5.2.7, 5.1.13, 4.2.25) to fix a High-severity SQL Injection flaw (CVE-2025-59681) affecting QuerySet methods in MySQL/MariaDB.

Rhadamanthys stealer's v0.9.2 update adds new anti-analysis checks, a custom executable format, and uses noisy PNG files for payload delivery to bypass security tools.

Argo CD patches multiple High-severity DoS flaws. A single unauthenticated webhook request can crash the entire argocd-server process via improper JSON handling.

The Detour Dog campaign is using DNS TXT records for stealthy C2, infecting thousands of websites and quickly shifting infrastructure to evade sinkholing efforts.

Russian-speaking Lunar Spider group is using the sophisticated Latrodectus V2 loader and a FakeCaptcha lure to gain initial access for ransomware operations.

CISA warns of a Critical RCE flaw (CVSS 9.8) in Megasys Telenium Online Web Application. The vulnerability allows unauthenticated attackers to execute arbitrary OS commands.

Autonomous vehicles represent a paradigm shift in transportation, promising enhanced safety and efficiency, yet their deep integration of…

On November 10, 2025, enforcement of the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) Final Rule begins…

Greetings, from Penta Security.

9/1 ~ 9/30 기간 동안의 Cloudbric Services Progress Report 공유 드립니다.

Here’s a clear breakdown of the $TRIAS to $NETX migration, including what’s happening, how to migrate, and important warnings:

We at rootissh are all about cybersecurity awareness! We are set on a journey of making the internet a safe place for ourselves and the…

Room URL: https://tryhackme.com/room/contiransomwarehgh

“DNS is like the address book of the internet. But just as criminals can fake addresses in real life, attackers exploit DNS to hide…

Recently, I had the chance to take the eLearnSecurity Junior Penetration Tester (eJPT) certification, and I wanted to share my honest…

An All-In-One hacking tool written in Python to remotely exploit Android devices using ADB (Android Debug Bridge) and Metasploit-Framework.

Unit 42 uncovers Phantom Taurus, a new Chinese APT using the fileless NET-STAR backdoor to target SQL databases and IIS servers in global espionage campaigns.

Varonis discovered MatrixPDF, a new toolkit that weaponizes PDFs with JavaScript and interactive lures to bypass email filters and redirect victims to phishing sites.