JPCERT exposed APT-C-60 targeting Japan via VHDX LNK files in phishing emails. The SpyGlace malware uses GitHub to fetch encrypted commands and statcounter for victim telemetry.

CISA warned of a Critical Auth Bypass flaw (CVE-2025-12108, CVSS 9.8) in Survision LPR Cameras. The lack of password enforcement allows unauthenticated attackers to gain full system access.

Let’s talk about memory. No, not that time you blanked on your SSH key passphrase during a live demo. We’re talking about RAM — the kind…

Updated November 1 with details of a click-to-contact threat as well as the latest ‘do not pay, do not phone’ PayPal TOAD attack.

During routine exploration of vulnerable servers, I discovered the presence of CVE-2017–9841 on a target domain using Nuclei with the…

An Alliance For Chip-Level Security

Introduction

IoT Devices Attacked Via Tor

Modern Windows defenses have a secret weapon against script-based threats: AMSI (Antimalware Scan Interface). AMSI allows Windows…

1. The OG Packet Filter (late 80s — early 90s)

A closer look at how attackers are misusing everyday AI tools like OpenAI’s API to sneak malware through trusted communication channels.

Google issued an urgent patch for CVE-2025-48593, a critical zero-click RCE flaw in Android (v13-16) that allows remote attackers to gain full device control. Update immediately.

Microsoft acknowledged a bug incorrectly displaying end-of-support warnings on supported Windows 10 LTSC/ESU editions. A cloud fix resolves the misleading notification.

Operation SkyCloak targets Russian/Belarus defense with a multi-stage backdoor using OpenSSH and Tor/obfs4 for stealthy C2. The malware checks for sandboxes before execution.

Google's Big Sleep AI found 5 WebKit flaws (buffer overflow, memory corruption) in Safari. Apple patched all operating systems; update immediately.

iOS 26.2 beta code suggests Apple is enabling third-party app stores in Japan to comply with new antitrust laws. Users report accessing AltStore & Epic Games Store.

Apple will reportedly pay Google $1B annually to license Gemini AI to power the next-gen Siri's "summarizer" and "planner" functions within its Private Cloud Compute.

Apple will disable automatic Wi-Fi credential sync on Apple Watch in the EU starting with iOS 26.2. The change stems from a dispute over accessory interoperability.

Microsoft Store now supports multi-app batch installation, allowing users to select and install multiple recommended apps from a curated list in a single click.

Google Maps integrates Gemini AI, replacing Assistant for natural, complex navigation and quick task handling. New features include Landmark Directions and Google Lens integration.

Google and Epic settled their antitrust suit, proposing changes to open the Play Store. The deal mandates third-party stores, alternative payments, and new fee caps (9-20%).