Chinese APT BRONZE BUTLER exploited CVE-2025-61932 in Motex LANSCOPE Endpoint Manager to gain SYSTEM access. CISA added the actively exploited zero-day to KEV.

CISA adds XWiki (CVE-2025-24893) and VMware (CVE-2025-41244) to its KEV Catalog after confirming active exploitation in the wild.

Netflix explores vertical video and podcast integration, signaling a new era of mobile entertainment without mimicking TikTok’s model.

The Brash exploit leverages a missing rate limit on Chromium's document.title API to trigger a Denial-of-Service attack, crashing browsers in seconds.

Samsung launched the Samsung Internet browser beta for Windows 10/11, featuring cross-device sync and Galaxy AI capabilities to advance its ambient AI ecosystem vision.

Google opened the US Play Store to external payment methods and alternative app downloads, a temporary measure following a US court mandate in the Epic Games antitrust case.

Urgent! DNN Platform has a Critical CVSS 10.0 flaw allowing unauthenticated users to overwrite files, leading to site defacement & XSS. Update to 10.1.1.

Wordfence exposed a Magecart campaign using a rogue WooCommerce plugin to hide skimmer code in a fake PNG image. The malware uses an AJAX backdoor to maintain access and steal customer cards.

Koi Security exposed PhantomRaven, an npm supply chain attack using 126 packages. It leverages Remote Dynamic Dependencies (RDD) and AI slopsquatting to steal GitHub/CI/CD secrets from 86,000+ downloads.

XLab exposed RPX_Client, a new PolarEdge malware that turns IoT/router devices into a global ORB proxy network. The ELF binary uses XOR to encrypt config and spreads across 40 countries.

Unit 42 exposed Airstalk, a suspected nation-state malware that abuses VMware AirWatch (MDM) APIs for a covert C2 dead drop. The tool is used to steal credentials and browser data in supply chain attacks.

Symantec exposed a Russian-aligned espionage campaign in Ukraine using LotL tactics. Attackers used a Sandworm-linked webshell (Localolive) and abused scheduled tasks to dump credentials and bypass Windows Defender.

Progress patched a High-severity DoS flaw (CVE-2025-10932) in MOVEit Transfer’s AS2 module. The vulnerability allows unauthenticated attackers to exhaust server resources. Patch to v2025.0.3 immediately.

Meta description: Become a sharper bug hunter. This professional guide by Monu Jangra (Certified Penetration Tester, LPT Master, CPENT…

“Discovery is the jigsaw — exploitation is finishing the picture.”

The photo looks clean. You cropped it, tweaked the lighting, maybe ran a filter. You think it’s anonymous. You post it.

Selama bertahun-tahun, banyak yang percaya bahwa iOS adalah sistem operasi paling aman di dunia mobile. Tapi apakah itu masih relevan di…

Protecting your money online has never been more important — here’s how to stay safe in the digital age.

Artificial intelligence (AI) has always carried an aura of invincibility. We trust it to recognize faces, drive cars, filter spam, and even…

By: Travis Ray Caverhill

“The skills I honed defending systems unexpectedly became my tools for creation.”