Descubre por qué WafW00f es esencial para identificar Web Application Firewalls, planear bypasses específicos y optimizar tu estrategia.

Google patches Gemini vulnerabilities exposing personal data, while the U.K. records its largest-ever Bitcoin seizure following an arrest

This guide covers the essential security checks every small team should use. Most of these tools are free or cheap, and they run…

How Cybersecurity OEMs Can Turn Risk into Revenue

Welcome back to Part 2 of our “Finding Evil” journey! If Windows Event Logs were a detective’s notebook, then Sysmon is like giving that…

The FSF celebrated its 40th anniversary by launching the LibrePhone project, an ambitious initiative to create a fully open and free-software mobile computing ecosystem.

A leaked memo revealed the US Army's NGC2 system had "critical deficiencies," including no RBAC and unverified cloud components, violating Zero Trust principles before testing.

Discord confirmed a breach at a third-party contractor exposed PII, limited payment details, and a small number of government ID images submitted for age verification.

A hacker alliance launched a leak site demanding $989.45M ransom to withhold 1 billion records stolen from Salesforce customers via OAuth token abuse and vishing.

A ZCS zero-day (CVE-2025-27915, CVSS 7.8) was actively exploited since Jan. 2025. Attackers used malicious calendar .ICS files to inject XSS and steal Zimbra webmail credentials.

A Critical (CVSS 9.8) zero-day RCE flaw (CVE-2025-61882) in Oracle E-Business Suite's BI Publisher component is being actively exploited by the Clop group for data theft.

LayerX disclosed CometJacking, a critical flaw that exploits a single crafted link to silently hijack Perplexity Comet’s AI agent, stealing Gmail and Calendar data.

The Confucius APT is actively targeting Pakistani entities with the Anondoor Python backdoor and WooperStealer, using DLL sideloading and sophisticated phishing to ensure long-term espionage.

A critical Unity bug (CVE-2025-59489) exposes games built since Unity 2017.1 to local code execution via argument injection. Developers must recompile and republish their titles.

Infoblox uncovered the Detour Dog campaign, which compromises 30K+ websites and uses covert DNS TXT records for C2 to deliver the StarFish shell and Strela Stealer malware.

OpenAI unveils the Apps SDK, transforming ChatGPT into a powerful “super app” where users can connect apps like Spotify, Canva, and Uber.

OpenAI selected AMD as a "core strategic computing partner," adopting Instinct MI450 GPUs for a 6 GW AI infrastructure. OpenAI can acquire a 10% equity stake in AMD.

OpenAI CEO Sam Altman announced at DevDay that ChatGPT now has 800 million weekly active users, making it the world's most dominant generative AI platform.

The Qt Group patched two critical flaws in Qt SVG: a UAF bug (CVE-2025-10729) that risks RCE, and recursive pattern element (CVE-2025-10728) leading to stack overflow DoS.

Elastic patched five flaws in Kibana/Elasticsearch, including three Critical XSS issues (CVE-2025-25009) and credential leaks, urging immediate upgrades to v8.18.8+.

CrowdStrike warns that the Critical RCE zero-day (CVE-2025-61882) in Oracle E-Business Suite is being actively exploited by GRACEFUL SPIDER (Clop affiliate) for corporate data theft. Patch immediately.