A XSS flaw in Open WebUI allows authenticated users to achieve Admin RCE by injecting JavaScript into rich text prompts, then exploiting the Functions feature. Update to v0.6.35.

A new campaign is using Bitcoin wallet lures to distribute DarkComet RAT. The UPX-packed trojan gains persistence via a fake explorer.exe binary and uses keylogging and remote control to steal data.

A Critical flaw in Lite XL (CVE-2025-12120) allows RCE when opening a project: the editor automatically executes malicious .lite_project.lua files, risking developer compromise.

But damned if I’m going to pay to migrate apps and more

AI Red Teaming is an evolving field focused on evaluating AI systems’ security by simulating attacks and identifying vulnerabilities.

Hey there, hacker 👋 — Vipul here from The Hacker’s Log. Let’s be honest: bug hunting looks glamorous on Twitter, right? Everyone posting

TTP-based detection catches known attacks. But what about zero-days and custom techniques? Statistical analysis and anomaly detection…

My First Panic Attack with the Hacker’s Toolbox (And What I Learned)

The Day My Eight-Year-Old Taught Me About Digital Safety

TL;DR: Google filed the first-ever lawsuit against a phishing-as-a-service operation called Lighthouse. The China-based syndicate stole $1…

The internet isn’t always open. Whether it’s a country-level block, a school firewall, or a regional content restriction, access can be…

In early November 2025, researchers disclosed a severe unauthenticated remote code execution vulnerability in Ubiquiti’s UniFi OS…

Introduction

Windows 11 now supports a new API allowing password managers (like 1Password, Bitwarden) to handle passkey authentication directly, simplifying cross-platform sign-in.

Valve unveiled Steam Frame VR, a standalone headset with Snapdragon 8 Gen 3, SteamOS, and Foveated Streaming, set to launch in early 2026.

Microsoft changed the KMS activation mechanism in Windows 11 (Build 26040+), removing the license transfer that KMS38 exploited, effectively breaking the activation method.

Seagate's new Exos 4U100 JBOD system offers 3.2 PB of high-density storage in a single chassis for AI and edge data centers, featuring HAMR and 30% lower power use.

Google will soon require all sideloaded Android apps to pass verification and code signing to combat fraud. However, the company is developing an "advanced process" for power users to bypass this.

Palo Alto patched a DoS flaw (CVE-2025-4619) in PAN-OS. An unauthenticated attacker can remotely reboot the firewall if URL proxy or decryption policies are enabled.

GitLab patched a High-severity Stored XSS flaw (CVE-2025-11224, CVSS 7.7) in the Kubernetes proxy feature. The bug allows authenticated users to hijack administrator sessions. Update to v18.5.2+.

Summary: