ISC warned of a High-severity DoS flaw (CVE-2025-11232) in Kea DHCPv4. A crafted DHCP packet can crash the server due to improper hostname validation, disrupting IP assignment. Patch to v3.0.2/3.1.3.

Urgent patch for WP Freeio plugin (v.< 1.2.22). Unauthenticated attackers can gain admin control instantly via a registration flaw. Update immediately to v.1.2.22.

Google Chrome 142 desktop update fixes 20 security flaws, including critical V8 Type Confusion (CVE-2025-12428) and Race conditions. Update your browser now.

Socket exposed an npm typosquat campaign using 10 fake packages (Netherеum.All). The malicious postinstall script deploys a 24MB PyInstaller stealer after prompting a fake CAPTCHA.

WSO2 patched three Critical flaws (CVSS 9.8) in API Manager/Identity Server. Flaws in regex access control and case-sensitive HTTP methods allow unauthenticated administrative takeover.

A critical hardware attack, TEE.fail, uses low-cost DDR5 memory bus interposition to extract root attestation keys from Intel TDX and AMD SEV-SNP. The flaw affects core server-grade TEEs.

ASEC exposed Trigona RaaS attacking exposed MS-SQL servers via brute-force. The group uses CLR Shell, a new Rust-based scanner, and the BCP utility to store and execute malware from database tables.

IIJ exposed a novel loader that simultaneously deploys TorNet (TOR C2) and PureHVNC (RAT) via DLL sideloading. It uses MurmurHash2 for API hashing and injects into jsc.exe for stealth.

A Babuk successor, Midnight ransomware, contains a critical flaw in its RSA key handling. Gen researchers created a free decryptor that bypasses the encryption, allowing victims to recover files.

HelixGuard exposed a VSCode supply chain attack using 12 malicious extensions. They steal source code, capture screenshots, and open reverse shells via Ngrok and AWS EC2 to compromise developers.

Google announced Chrome 154 (Oct 2026) will automatically enable “Always Use Secure Connections,” marking a major security push to combat MitM attacks by warning users before visiting unencrypted HTTP sites.

BitSight uncovered a Lampion banking Trojan campaign using ClickFix lures and a 700MB bloatware DLL to evade AV. The VBScript loader establishes persistence via the Windows Startup folder.

There are two truths I live by: one, always keep coffee within arm’s reach; two, curiosity + an API = bad decisions that turn into CVEs…

You scan once. You move on. You think you’re done……You’re not done. You’re just blind.

Executive Summary

After taking a short break from cybersecurity to focus on some life events, we’re back on CyberDefenders, solving a few of their free labs…

The most effective cybersecurity programs are built by small, elite teams operating with clarity, purpose, and the right leader at the…

SHELLSILO is a cutting-edge tool that translates C syntax into syscall assembly and its corresponding shellcode. It streamlines the process of constructing and utilizing structures, assigning vari…

A critical vulnerability (CVE-2025-10680) in OpenVPN beta builds allows an unauthenticated attacker to execute arbitrary commands on Linux/macOS clients via DNS parameter injection.

The BiDi Swap attack exploits flaws in Unicode's bidirectional text rendering to make malicious URLs look legitimate, tricking users and bypassing browser security.