A RCE flaw (CVE-2025-64439) in LangGraph's JsonPlusSerializer allows arbitrary Python code execution by exploiting a fallback during checkpoint deserialization. Update to v3.0.

Datadog exposed MUT-4831, a cluster that deployed Vidar Infostealer via 17 malicious npm packages. The malware uses postinstall scripts to download and execute the payload, stealing credentials and crypto wallets.

Elastic patched a High-severity flaw (CVE-2025-37735) in Elastic Defend for Windows. A local attacker can delete arbitrary files via the SYSTEM service, risking privilege escalation. Update to v8.19.6+.

A China-linked APT targeted a U.S. policy nonprofit for weeks in April 2025. The group used DLL sideloading via a VipreAV binary and msbuild.exe scheduled tasks to achieve SYSTEM persistence for espionage.

Medusa & DragonForce RaaS groups weaponize SimpleHelp RMM flaws (CVE-2024-57726/7/8) to gain SYSTEM-level access to customer networks. Immediate patch needed.

Kimsuky APT is using a Themes.js JavaScript loader and certutil LOLBIN to gain minute-by-minute persistence via a Windows Scheduled Task. The APT is targeting think tanks for espionage.

A High-severity LPE flaw (CVE-2025-55680) in the Windows Cloud Files Driver allows local users to gain SYSTEM privileges by exploiting a TOCTOU race condition. Patch immediately.

Let’s talk facts, not feelings.

Can We Take The Hook ? Lets Try ..

Summary

Why Russian Ransomware Gangs Never Attack Their Own Backyard In the ever-shifting terrain of cybercrime, few attribution markers are as revealing as the pattern of CIS avoidance — the deliberate …

The Business of Harvesting VPN Credentials for Resale Attackers are harvesting Virtual Private Network (VPN) login credentials on an industrial scale and monetizing them in a thriving underground …

Introduction

Governance, Risk, and Compliance (GRC) has long been the cornerstone of enterprise risk management. On paper, it ensures alignment between…

APIs are a core part of how modern web applications work. They enable smooth communication between frontend and backend systems, helping…

1)What happens when I type google.com in the browser?

A Beginner’s Challenge in Sigma Rule Analysis.

How deepfake voices and synthetic identities are breaking biometric authentication — and the technical stack you need to fight back.

GDIOCSpider is a new open-source Python tool for Incident Response. It crawls Google Drive, extracts IOCs (Indicators of Compromise), and outputs them to a CSV.

Microsoft is testing a faster Quick Machine Recovery (QMR) with a single scan and now allows Smart App Control (SAC) to be toggled in settings without reinstallation.

Nine NuGet packages were found with covert code scheduled to activate in 2027-2028, targeting SQL databases and Siemens PLCs with sudden process terminations.