A flaw in the Blink engine (Chrome, Edge, Brave, etc.) lets a single webpage overload the main thread via rapid document.title updates, causing a total browser freeze.

Researchers bypassed all modern TEEs (Intel, AMD, Nvidia) using a cheap physical attack targeting DDR5 systems, exposing a critical "security illusion" in hardware trust.

CVE-2025-12080 in Google Messages on Wear OS allows any app to silently send SMS/MMS messages, bypassing permissions. Update immediately to prevent fraud.

Ex-L3Harris contractor pleaded guilty to selling 8 US military zero-day exploits to Russia-linked broker Operation Zero for millions in crypto. Faces 9 years in prison.

New PhantomRaven npm malware uses AI "slopsquatting" and invisible dynamic dependencies to steal GitHub, GitLab, and CI/CD tokens. Update vigilance now.

Google Chrome 154 (Oct 2026) will default to "Always use secure connections" for all public sites, eliminating the single biggest risk from unencrypted HTTP.

A new, sophisticated phishing campaign uses invisible soft hyphens (­) in email subject lines to bypass filter detection and steal user credentials. Learn how.

New report reveals AI-driven email fraud & compromised VPNs (83% of ransomware) cause 90% of cyber incidents. Ditch legacy SEGs & high-risk on-prem VPNs.

Chinese APT BRONZE BUTLER exploited CVE-2025-61932 in Motex LANSCOPE Endpoint Manager to gain SYSTEM access. CISA added the actively exploited zero-day to KEV.

CISA adds XWiki (CVE-2025-24893) and VMware (CVE-2025-41244) to its KEV Catalog after confirming active exploitation in the wild.

Netflix explores vertical video and podcast integration, signaling a new era of mobile entertainment without mimicking TikTok’s model.

The Brash exploit leverages a missing rate limit on Chromium's document.title API to trigger a Denial-of-Service attack, crashing browsers in seconds.

Samsung launched the Samsung Internet browser beta for Windows 10/11, featuring cross-device sync and Galaxy AI capabilities to advance its ambient AI ecosystem vision.

Google opened the US Play Store to external payment methods and alternative app downloads, a temporary measure following a US court mandate in the Epic Games antitrust case.

Urgent! DNN Platform has a Critical CVSS 10.0 flaw allowing unauthenticated users to overwrite files, leading to site defacement & XSS. Update to 10.1.1.

Wordfence exposed a Magecart campaign using a rogue WooCommerce plugin to hide skimmer code in a fake PNG image. The malware uses an AJAX backdoor to maintain access and steal customer cards.

Koi Security exposed PhantomRaven, an npm supply chain attack using 126 packages. It leverages Remote Dynamic Dependencies (RDD) and AI slopsquatting to steal GitHub/CI/CD secrets from 86,000+ downloads.

XLab exposed RPX_Client, a new PolarEdge malware that turns IoT/router devices into a global ORB proxy network. The ELF binary uses XOR to encrypt config and spreads across 40 countries.

Unit 42 exposed Airstalk, a suspected nation-state malware that abuses VMware AirWatch (MDM) APIs for a covert C2 dead drop. The tool is used to steal credentials and browser data in supply chain attacks.

Symantec exposed a Russian-aligned espionage campaign in Ukraine using LotL tactics. Attackers used a Sandworm-linked webshell (Localolive) and abused scheduled tasks to dump credentials and bypass Windows Defender.

Progress patched a High-severity DoS flaw (CVE-2025-10932) in MOVEit Transfer’s AS2 module. The vulnerability allows unauthenticated attackers to exhaust server resources. Patch to v2025.0.3 immediately.