Microsoft’s 2025 Digital Defense Report details a 32% rise in identity attacks, the weaponization of AI in phishing, and new state-sponsored tactics.

Microsoft's open ExCyTIn-Bench simulates a SOC center to measure AI's ability to investigate complex cyber incidents, going beyond simple knowledge tests.

Windows 11 updates KB5066835 & KB5065789 broke local HTTP/2 connections on 127.0.0.1, causing critical failures for developers and services.

CISA adds a critical, actively exploited Adobe Experience Manager (AEM) RCE flaw (CVSS 10.0) to its KEV catalog, demanding immediate patching.

Synacktiv exposed LinkPro, an advanced Linux rootkit using eBPF to cloak activity on Kubernetes nodes. It is activated by a "magic" TCP packet (window size 54321) to establish covert remote control.

A Critical (CVSS 10.0) flaw in Squid proxy (CVE-2025-62168) leaks HTTP authentication credentials and security tokens through error messages.

Koi Security exposed GlassWorm, the first VSCode worm that spreads autonomously, using invisible Unicode to hide malicious code. It uses Solana blockchain and Google Calendar for a resilient C2.

SEQRITE exposed CAPI, a .NET trojan targeting Russian FinTech with malicious LNK resumes. It uses rundll32 for execution and a hidden "Security" scheduled task for persistence.

Mandiant exposed UNC5142 for using EtherHiding—hiding malicious JavaScript in BNB Smart Chain smart contracts—to create a resilient C2 and distribute VIDAR/ATOMIC to 14,000+ sites.

A spamware network of 131 cloned Chrome extensions (YouSeller, Botflow) is abusing WhatsApp Web for automated messaging. The DBX Tecnologia reseller scheme affects 20K+ users.

FortiGuard exposed a cross-regional campaign that expanded to Malaysia using HoldingHands malware. The malware hijacks Task Scheduler via TimeBrokerClient.dll to achieve stealthy persistence.

NTT exposed WaterPlum APT's multi-platform OtterCandy RAT (v2), which uses Node.js for remote control, targets 7 browser extensions, and now includes anti-forensic trace deletion.

Moxa patched five critical flaws in its industrial routers, including a CVE-2025-6950 (CVSS 9.9) bug where hard-coded JWT credentials allow unauthenticated attackers to impersonate any user. Update to v3.21.

Google Project Zero disclosed a zero-click RCE flaw (CVE-2025-54957, CVSS 7.0) in Dolby's Audio Decoder. The integer overflow can be triggered by a single audio file and affects Android, iOS, and macOS.

Google exposed UNC5342 (DPRK APT) using EtherHiding—hiding JADESNOW/INVISIBLEFERRET malware in BNB/Ethereum smart contracts—for a resilient, nation-state C2 infrastructure.

Google officially terminated its Privacy Sandbox initiative due to low adoption of its new ad technologies (FLoC, Topics API). The decision marks the end of Google's plan to replace third-party cookies in Chrome.

NVIDIA recently announced a milestone of profound symbolic significance, as CEO Jensen Huang personally unveiled the first Blackwell wafer manufactured on U.S. soil during a celebratory event. Thi…

Apple has announced a landmark five-year exclusive broadcasting agreement with Formula 1’s parent company, Liberty Media, granting Apple TV the sole rights to stream all F1 races in the United Sta…

Researchers at HiddenLayer have disclosed a critical arbitrary code execution vulnerability in the Keras 3 deep learning framework (CVE-2025-49655, CVSS 9.8), which affects the Torch backend of Ke…

The Wikimedia Foundation reported an 8% drop in page views, blaming AI chatbots and search summaries for siphoning traffic. It warns the decline threatens the sustainability of its volunteer community.

My 4-Hour Fuzzing Process on a Government VDP: Wordlists, Recursion, and Filter Tricks to Bypass WAFs and Find Leaks.