Sauter patched six flaws in modulo 6 devices. The Critical CVE-2025-41723 (CVSS 9.8) flaw allows unauthenticated file upload via the SOAP interface, risking RCE. Update to v3.2.0.

Kaspersky exposed the resurfaced PassiveNeuron campaign targeting Asia via MS SQL servers. The APT deploys custom Neursite and NeuralExecutor backdoors using Phantom DLL Hijacking for stealth persistence.

Unit 42 exposed Scattered LAPSUS$ Hunters pivoting to Extortion-as-a-Service (EaaS) after Salesforce leaks. The group is recruiting insiders and teasing SHINYSP1D3R ransomware on Telegram.

ABB disclosed a Critical (CVSS 9.9) Missing Auth flaw (CVE-2025-9574) in EoL ALS-mini-S4/S8 load controllers, allowing unauthenticated remote config access. No patch will be released.

Qianxin exposed Bitter APT using a WinRAR path traversal flaw and malicious Office macros to deploy a C# backdoor against military/FinTech targets in Asia. The attack sets up scheduled persistence.

Google exposed Russia's COLDRIVER APT deploying a new "ROBOT" malware family (NOROBOT, YESROBOT) just 5 days after its LOSTKEYS tool was disclosed. The multi-stage malware uses a ClickFix lure.

A Windows Agere Modem EoP flaw (CVE-2025-24990) under active exploit allowed arbitrary kernel R/W even when unused. Microsoft removed the driver in the October update. PoC is available.

The WSO2 project has released urgent security advisories addressing two critical access control vulnerabilities—CVE-2025-9804 and CVE-2025-10611—that affect multiple enterprise products, including…

Dnsrecon: Tool for exhaustive enumeration of DNS records, AXFR detection, and infrastructure mapping in Bug Bounty.

The classic one-liner that spawns processes until your system chokes. Learn how it works, how to detect it, and defensive measures every…

It doesn’t take a hacker with fancy tools to breach your system. Sometimes, all it takes is a weak password. Or a quick click on a…

Your new goal: practical obscurity.

CYBER SECURITY CLASS REVIEW ON 21ST OF OCTOBER, 2025 General Kali commands: CD PWD LS Touch /root /etc /Home /LIB Cat Mv rm Mkdir Whoami The command for steganography is Steghide(for encryption) and …

While the full scope of the breach remains under investigation, state officials confirmed that some data was exfiltrated, though the…

IAR: The Trading Platform That Builds Strength Through Recovery In the ever-changing world of online trading, success isn’t just about winning — it’s about bouncing back after setbacks …

A fake "Safe Downloader" on the official Xubuntu site contained a crypto clipper trojan, forcing the distribution to take its downloads page offline.

XSS Exploitation Tool is a penetration testing tool that focuses on the exploitation of Cross-Site Scripting vulnerabilities.

South Korea confirms a major cyberattack on the Onnara document system and GPKI certificates, two months after the breach was detected.

CISA warns that a critical Windows SMB flaw (CVE-2025-33073) is actively exploited, allowing authenticated attackers to gain SYSTEM privileges.

The Everest ransomware group claimed the attack on Collins Aerospace, alleging theft of 50GB of data, following the airport check-in system failures in September.

A US federal court granted a permanent injunction, banning NSO Group from all future attempts to access WhatsApp, concluding a 6-year legal battle.