Researchers unveil "Training Solo," a new Spectre-v2 study showing attackers can bypass isolation to self-train branch predictors and steal kernel data.

A new LFI zero-day (CVE-2025-11371) in CentreStack is actively exploited to bypass a previous RCE patch and steal credentials. Patch immediately.

Microsoft revoked over 200 digital certificates abused by Rhysida ransomware to spread malware disguised as legitimate Microsoft Teams installers via SEO poisoning.

A dark web post claims 3TB of data from two Russian SMS aggregators has been stolen, posing a huge risk of mass account takeover via 2FA codes.

A new phishing campaign is impersonating LastPass, Bitwarden, & 1Password to trick users into installing malware & stealing their master passwords.

Microsoft’s 2025 Digital Defense Report details a 32% rise in identity attacks, the weaponization of AI in phishing, and new state-sponsored tactics.

Microsoft's open ExCyTIn-Bench simulates a SOC center to measure AI's ability to investigate complex cyber incidents, going beyond simple knowledge tests.

Windows 11 updates KB5066835 & KB5065789 broke local HTTP/2 connections on 127.0.0.1, causing critical failures for developers and services.

CISA adds a critical, actively exploited Adobe Experience Manager (AEM) RCE flaw (CVSS 10.0) to its KEV catalog, demanding immediate patching.

Synacktiv exposed LinkPro, an advanced Linux rootkit using eBPF to cloak activity on Kubernetes nodes. It is activated by a "magic" TCP packet (window size 54321) to establish covert remote control.

A Critical (CVSS 10.0) flaw in Squid proxy (CVE-2025-62168) leaks HTTP authentication credentials and security tokens through error messages.

Koi Security exposed GlassWorm, the first VSCode worm that spreads autonomously, using invisible Unicode to hide malicious code. It uses Solana blockchain and Google Calendar for a resilient C2.

SEQRITE exposed CAPI, a .NET trojan targeting Russian FinTech with malicious LNK resumes. It uses rundll32 for execution and a hidden "Security" scheduled task for persistence.

Mandiant exposed UNC5142 for using EtherHiding—hiding malicious JavaScript in BNB Smart Chain smart contracts—to create a resilient C2 and distribute VIDAR/ATOMIC to 14,000+ sites.

A spamware network of 131 cloned Chrome extensions (YouSeller, Botflow) is abusing WhatsApp Web for automated messaging. The DBX Tecnologia reseller scheme affects 20K+ users.

FortiGuard exposed a cross-regional campaign that expanded to Malaysia using HoldingHands malware. The malware hijacks Task Scheduler via TimeBrokerClient.dll to achieve stealthy persistence.

NTT exposed WaterPlum APT's multi-platform OtterCandy RAT (v2), which uses Node.js for remote control, targets 7 browser extensions, and now includes anti-forensic trace deletion.

Moxa patched five critical flaws in its industrial routers, including a CVE-2025-6950 (CVSS 9.9) bug where hard-coded JWT credentials allow unauthenticated attackers to impersonate any user. Update to v3.21.

Google Project Zero disclosed a zero-click RCE flaw (CVE-2025-54957, CVSS 7.0) in Dolby's Audio Decoder. The integer overflow can be triggered by a single audio file and affects Android, iOS, and macOS.

Google exposed UNC5342 (DPRK APT) using EtherHiding—hiding JADESNOW/INVISIBLEFERRET malware in BNB/Ethereum smart contracts—for a resilient, nation-state C2 infrastructure.

Google officially terminated its Privacy Sandbox initiative due to low adoption of its new ad technologies (FLoC, Topics API). The decision marks the end of Google's plan to replace third-party cookies in Chrome.