ASEC exposed a flaw in Gunra Linux ransomware: its ChaCha20 keys are generated using an insecure time()/rand() seed, potentially allowing victims to brute-force decryption and recover files.

Herodotus is a new Android banking Trojan that evades anti-fraud systems by simulating human input: it inserts randomized typing delays (300-3000ms) during remote-control attacks in Italy and Brazil.

A path traversal flaw (CVE-2025-62725) in Docker Compose lets attackers overwrite host files via remote OCI artifact annotations, triggered by read-only commands.

Kaspersky exposed BlueNoroff's GhostCall/GhostHire campaigns, which use AI-enhanced lures (GPT-4o images) and trojanized apps to target executives and developers, deploying SilentSiphon spyware on macOS.

A flaw (CVE-2025-12080) in Google Messages for Wear OS allows any installed app to send SMS/RCS messages without permission by abusing ACTION_SENDTO intents.

Akamai warns of active exploitation of Magento's SessionReaper flaw (CVE-2025-54236). The critical (CVSS 9.8) vulnerability allows session hijacking and unauthenticated RCE via web shells.

AhnLab exposed Beast ransomware (Monster evolution) as a new RaaS threat, with 16+ victims by August 2025. It uses ChaCha20 encryption, deletes Shadow Copies, and features a hidden GUI control panel.

A Critical (CVSS 10.0) flaw (CVE-2025-61481) in MikroTik RouterOS/SwOS exposes the WebFig management interface over unencrypted HTTP by default, allowing remote credential theft via MitM.

Trend exposed the Water Saci worm, a self-propagating campaign that hijacks WhatsApp Web using Selenium/PowerShell. It uses a stealthy IMAP email C2 channel with HTTP fallback.

AhnLab exposed Rhadamanthys Infostealer hiding in games built with the Ren'Py engine. It uses a fake 1M-second loading screen to distract victims while injecting malware via a malicious Python script.

To understand what a CORS vulnerability is, we first need to know what CORS means and why browsers use it.

ParamSpider: Tool for passive recognition and extraction of URLs with parameters. Essential for discovering XSS, SQLi, and LFI.

We are going to dive into the PAN OS Command Injection Vulnerability (CVE-2024–3400). This attack is a command injection resulting from an…

Events Timeline

CVE-2025–61884 has been disclosed for Oracle E-Business Suite (EBS). The affected component, Oracle Configurator Runtime UI, can be…

What really happens when you click that one wrong link?

As a self-paced cyber learner, I started to learn Bash before jumping to the vast Linux tool sets and technologies. By profession, I am a…

Learn how employee cybersecurity awareness can safeguard your business from common cyber threats.

In 2026, the Integrated Systems Europe (ISE) event in Barcelona will host a pivotal Cybersecurity Summit — and it’s more than just a tech…

In today’s digital landscape, safeguarding your confidential information is paramount. As a business owner or IT professional, you…

Follow our easy walkthrough to unlock exclusive X benefits.