Huntress discovered active exploitation of an unpatched LFI zero-day (CVE-2025-11371) in Gladinet/Triofox. Attackers chain the flaw to steal the machine key and achieve RCE without authentication.

Apple doubled its top reward to $2M (up to $5M with bonuses) for zero-click exploits that mimic mercenary spyware and bypass Lockdown Mode protections. The new rules take effect in November.

Zimperium exposed ClayRat, an Android spyware that spreads rapidly by auto-sending malicious links to contacts. It spoofs popular apps like WhatsApp and TikTok and steals SMS/call logs.

Cisco Talos confirms Storm-2603 is abusing an outdated Velociraptor build (CVE-2025-6264) for persistence and arbitrary code execution, deploying LockBit and Babuk ransomware.

Microsoft warns of Storm-2657, a financial crime group exploiting weak MFA via AiTM phishing. The group hijacks university accounts to reroute salary payments through Workday HR and conceal tracks.

Researchers at FireTail have discovered the resurrection of an old-class flaw — ASCII Smuggling — now resurfacing in

Critical flaws (CVE-2025-11001 & CVE-2025-11002) in 7-Zip allow unauthenticated RCE when extracting malicious ZIP files. Attackers can overwrite system files via directory traversal. Update to v25.00.

A critical flaw (CVE-2025-59145, CVSS 9.6) in GitHub Copilot allowed zero-click data theft. Attackers injected hidden prompts into pull requests, which the agent obeyed to exfiltrate private code via the Camo image service.

A Critical (CVSS 10.0) Use-After-Free flaw (CVE-2025-49844) in Redis's Lua parser allows authenticated attackers to achieve Remote Code Execution. Update immediately to v8.2.2.

The RondoDox botnet launched a massive, short-burst campaign, exploiting 56 vulnerabilities in routers and IoT devices with an "exploit shotgun" technique to spread Mirai and Morte malware globally.

Forescout exposed hacktivist group TwoNet for fabricating a critical water utility attack after compromising an OT honeypot with admin/admin credentials and exploiting a known XSS flaw.

OpenSSH (before 10.1) has a flaw (CVE-2025-61984) allowing RCE via the ProxyCommand and specially crafted usernames. The exploit uses shell syntax errors in Bash to inject malicious commands.

Official support for Windows 10 ends Oct 14. Microsoft urges users to upgrade to Windows 11 or enroll in the ESU program for continued critical security updates.

Mozilla is developing a new, browser-only Firefox VPN feature, similar to IP Protection, that will encrypt in-browser traffic and conceal the user's IP address as a premium subscription service.

LineageOS 23.0, based on Android 16 QPR0, introduces a rewritten Camera app, the Catapult TV Launcher to remove ads, and enhanced virtualization capabilities.

Oracle issued an emergency alert for a critical flaw (CVE-2025-61884) in E-Business Suite. The bug allows unauthenticated remote access to sensitive EBS resources.

Friend Link- Link

Unlock the secrets to landing exclusive private program invites and level up your bug bounty journey.

Hey there!😁

Tải Hack Tank Stars (Full Tiền, Kim Cương) v2.13.200 Phiên bản Hack Tank Stars nâng cấp trải nghiệm lên một tầm cao mới. Người chơi không chỉ có vô hạn tiền và …

There is an AI chatbot online that, by 2025, had become a crypto millionaire, a cultural provocateur, an originator of a weird meme…