A High-severity flaw (CVE-2024-21635) in Memos fails to invalidate Access Tokens upon password change, allowing attackers to maintain access to the knowledge base. Update to v0.25.2.

Cisco Talos reports Kraken, a HelloKitty successor, is a cross-platform RaaS targeting Windows/ESXi. The malware uniquely benchmarks CPU/IO to optimize encryption speed and uses Cloudflared/SSHFS for persistence.

IBM patched four critical flaws in AIX/VIOS. The RCE (CVSS 10.0) in nimesis and CVE-2025-36096 allow remote attackers to execute commands and obtain NIM private keys. Update immediately.

NVISO exposed the Contagious Interview APT using JSON Keeper and npoint.io as covert C2 channels. The North Korean group uses fake job lures on GitLab to deploy BeaverTail to steal Web3 credentials.

AWS Inspector exposed the largest npm supply chain incident ever: 150,000+ malicious packages were uploaded in a coordinated campaign to exploit tea.xyz token rewards via tea.yaml files.

CISA warned of four flaws in Lynx+ Gateway. The Critical (CVSS 10.0) Auth Bypass allows unauthenticated remote reset and cleartext credential theft. Vendor GIC has not responded to CISA.

Despite a recent doxxing attempt, Lumma Stealer has resurfaced, integrating browser fingerprinting into its C&C to collect WebGL/Canvas signatures for sandbox evasion and victim assessment.

A new report from Group-IB exposes a highly automated phishing framework engineered to impersonate Italian IT and web-services giant Aruba S.p.A., a company serving more than 5.4 million customers…

Security researchers at AhnLab have identified Yurei, a newly emerging ransomware group first observed in early September 2025. The group operates with a classic double-extortion model, infiltrati…

Most security labs are built around predictable, well-documented vulnerabilities. But every once in a while, during experimentation, you…

Vamos a hacer una nueva máquina, “Expressway”. Esta no tenía ninguna información, así que la cosa se ponía interesante desde el principio.

This isn’t just another VPN. It’s a high-performance security toolkit for users who demand control.

People who discuss global digital payment systems tend to focus on Western tap-to-pay systems and Asian super-app platforms. However, the…

Are you trying to set up port forwarding for a game, keep a network printer reliably connected, or just take better control of your home…

(Use this only for ethical and educational purpose project only )

When I talk to people switching to privacy-focused browsers, one of the first points of confusion is always DuckDuckGo’s history. Users…

Hunt down IAM misconfigurations before attackers turn your credentials into their playground

Today, I built a small home network on Cisco Packet Tracer. I couldn’t get the wireless router to connect to the webcam, which is an IoT…

Anthropic confirmed the first AI-orchestrated cyber-espionage case: the China-linked GTG-1002 group used Claude Code to execute 80–90% of the intrusion cycle against 30 global targets.

Microsoft closed the KMS38 loophole by removing gatherosstate.exe in Windows Build 26040, killing the offline method that granted Windows activation until 2038.

Red Hat proposed making C++20 (GNU++20) the default language standard in GCC, replacing C++17. The shift may appear in a version after the upcoming GCC 16 release.