Ivanti disclosed 13 EPM flaws, including a High-severity RCE (CVE-2025-9713) and 11 Medium SQL Injection bugs. Fixes are scheduled for Nov 2025 and Q1 2026.

Apple faces a second class-action lawsuit claiming its AI models were trained using pirated books from "shadow libraries." The suit cites Anthropic's recent $1.5B copyright settlement.

Early OneDrive testers found Microsoft's new AI facial recognition feature can only be disabled three times per year. The feature is opt-out by default for preview users.

Google is integrating its Nano Banana AI image editor across Search, NotebookLM, and Photos. The feature will enhance video overviews and enable AI image editing via conversational prompts.

Microsoft updated Edge’s IE Mode policy after a Chakra zero-day was exploited via phishing. Users must now manually enable and whitelist domains to prevent remote device compromise.

OpenAI partnered with Broadcom to design and deploy custom AI accelerator chips for 10 gigawatts of infrastructure by 2029, strategically reducing its reliance on external suppliers like NVIDIA.

Google Chrome will now automatically revoke notification permissions from inactive websites (those with low click-through rates) to significantly reduce user interruptions and spam.

Apple introduced native threat notifications in iOS 26.1 Beta 3, allowing immediate Lockdown Mode alerts to appear directly in the Notification Center when mercenary spyware attacks are detected.

CERT/CC warns that Clevo’s UEFI firmware updates accidentally exposed Intel Boot Guard private keys (CVE-2025-11577), risking pre-boot firmware integrity on multiple OEM laptops.

A Critical (CVSS 9.1) flaw (CVE-2025-37729) in Elastic Cloud Enterprise allows authenticated Admin RCE. Attackers exploit Jinjava template injection to exfiltrate data and execute commands.

ETH Zurich exposed RMPocalypse, a deterministic flaw in AMD SEV-SNP that bypasses memory integrity during initialization, allowing a malicious hypervisor to compromise Confidential VMs (Zen 3/4/5) with 100% success.

Seqrite discovered a campaign using SVG smuggling and a fake Colombian court lure to deploy AsyncRAT. The SVG executes JS to stage a malicious HTA file, evading detection.

Malicious packages across npm, PyPI, and RubyGems are exploiting Discord webhooks as stealthy, resilient C2 endpoints to exfiltrate developer config files and sensitive host data.

A consortium of LAPSUS$/ShinyHunters hackers launched an EaaS campaign, claiming 1 billion records stolen from 39 Salesforce customers, and demanded a ransom before an October 10 deadline.

McAfee uncovered the Astaroth banking Trojan using GitHub for C2 backup, hiding encrypted configuration data via steganography in images to target Brazilian financial and crypto users.

Ming-Chi Kuo reports that the iPhone Fold's critical hinge mechanism cost has been reduced to $70-$80 per unit, improving profit margins and accelerating its mass production feasibility.

MIT & Toyota unveiled Steerable Scene Generation, an AI tool that uses Monte Carlo Tree Search (MCTS) to autonomously create 44M+ realistic 3D virtual scenes for training robots.

Windows Copilot's new Connector feature allows users to link Google (Gmail, Drive, Calendar) and Microsoft cloud accounts, enabling cross-platform AI search and document generation.

🤑Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in Apache OFBiz.This issue affects Apache…

Kita akan melakukan reconnaessance dan Vulnerability Scanning pada port yang sudah disediakan untuk mencari celah pada sebuah server. Step…

When you first hear the phrase “dumpster diving,” your mind probably jumps to grimy alleys, overflowing trash bins, and the occasional lost…