The Qt Group patched two critical flaws in Qt SVG: a UAF bug (CVE-2025-10729) that risks RCE, and recursive pattern element (CVE-2025-10728) leading to stack overflow DoS.

Elastic patched five flaws in Kibana/Elasticsearch, including three Critical XSS issues (CVE-2025-25009) and credential leaks, urging immediate upgrades to v8.18.8+.

CrowdStrike warns that the Critical RCE zero-day (CVE-2025-61882) in Oracle E-Business Suite is being actively exploited by GRACEFUL SPIDER (Clop affiliate) for corporate data theft. Patch immediately.

A Critical (CVSS 9.7) DNS rebinding flaw (CVE-2025-59159) in the SillyTavern LLM interface allows remote attackers to seize full control of local AI instances and steal API keys.

A Critical (CVSS 10.0) zero-day RCE flaw (CVE-2025-10035) in GoAnywhere MFT is being actively exploited by the Medusa ransomware group, Storm-1175. Patch immediately.

IBM patched a Critical (CVSS 9.3) LPE flaw (CVE-2025-36356) in Verify Access/Identity Access that allows locally authenticated users to escalate privileges to root. Update to v10.0.9.0-IF3 now.

Rapid7 exposed the unauthenticated RCE chain in Cisco ASA/FTD. CVE-2025-20362 bypasses auth to reach CVE-2025-20333, a buffer overflow in the WebVPN Lua script. Patch immediately.

A critical UAF flaw in the Linux Traffic Control subsystem (CVE-2023-4921, CVSS 7.8) allows local privilege escalation to root. A fully detailed PoC exploit has been released.

A Chinese APT used fake Cloudflare verification pages and malicious LNK files to inject PlugX via DLL sideloading into a Serbian aviation agency, aiming for long-term espionage.

CYFIRMA uncovered Yurei Ransomware, a sophisticated Go-based double-extortion threat that uses ChaCha20 encryption, anti-forensic wipes, and disguises itself as WindowsUpdate.exe to propagate over SMB.

APT SideWinder launched Operation SouthNet, targeting South Asia with over 50 malicious phishing portals hosted on Netlify and pages.dev to steal government and military credentials.

Targeted Lists, Faster Payouts — How Precision Beats Volume

The tech giant unveils autonomous vulnerability patching, enhanced bug bounties, and ransomware protection in comprehensive security…

Name Challenge: where are the robots

Recent drone incursions in Copenhagen and Oslo, combined with ransomware attacks on major airports including Heathrow, reveal critical…

🚨 The Most Dangerous Bug in Your Code Isn’t a Syntax Error

linkedin

WPAxFuzz is capable of fuzzing either any management, control or data frame of the 802.11 protocol or the SAE exchange.

Romanian researchers unveiled ARGUS, an autonomous robot that detects hybrid threats by merging AI computer vision and network intrusion monitoring in a single mobile platform.

A Chinese court delivered a severe verdict against the Myanmar "Four Great Families," sentencing 16 to death for operating armed fraud enclaves along the border.