Splunk uncovered a new .NET steganographic loader that hides LokiBot malware inside embedded BMP and PNG image files. The multi-stage loader uses a separate container module, evading static detection.

A new macOS stealer (Nova) uses LaunchAgents to install a modular backdoor. Its main function is replacing legitimate Ledger/Trezor apps with phishing clones that exfiltrate seed phrases as users type.

Authentication failures, JWT token management, and mitigation. Detection of persistence and brute-force attacks.

Introducción

Building Your Digital Workshop: A Guide to Local PHP Environments

It was November 18, 2025, and if you were working online, you probably remember that sudden, frustrating moment when websites just……

In September 2025, an event occurred that the cybersecurity community had been predicting — and fearing — for years.

Cloudflare Outage Briefly Takes Down Parts of the Internet — Including ChatGPT and X Earlier today, a widespread outage at Cloudflare — one of the world’s most critical internet …

This is an SQL injection lab I exploited on PortSwigger.
 The goal is to take advantage of the SQLi vulnerability inside the product…

Belonging to the Era of Internet it is normal to be indulged in Social Media as Teenagers but that doesn’t mean it is Safe

The deployment was live. Users were accessing the application seamlessly through CloudFront. Everything appeared perfect, until I opened…

We are living in a world where everything from wristwatches to industrial turbines insists on being “smart.”
But behind all the smart…

A vulnerability that allows unauthorized users to take over user accounts, potentially including administrator accounts, without any…

السلام عليكم ورحمة الله

CISA added a FortiWeb RCE flaw (CVE-2025-58034) to its KEV Catalog due to active exploitation. The bug allows authenticated attackers to execute arbitrary code on the WAF via crafted requests. Update now.

Oligo exposed ShadowRay 2.0, a massive, evolving campaign using AI-generated malware to turn 230K exposed Ray AI clusters into a self-propagating cryptomining and DDoS botnet.

D-Link warned that DIR-878 has reached EOL with three unpatched RCE flaws. Unauthenticated remote attackers can execute arbitrary commands via Dynamic DNS and DMZ settings due to insecure CGI parameters.

METZ CONNECT patched five critical flaws in EWIO-2 industrial controllers. CVE-2025-41734 allows unauthenticated PHP RCE, and CVE-2025-41733 risks admin credential reset. Update to v2.2.0 immediately.

LayerX exposed a 6-year, 9M-install campaign: Fake VPN/ad-blocking Chrome extensions hijack all user traffic via remote PAC proxy scripts, enabling surveillance and data exfiltration.

SolarWinds patched three Critical RCE flaws (CVSS 9.1) in Serv-U. An authenticated admin can exploit them for code execution and directory path bypass. Update to v15.5.3 immediately.

Socket exposed a new npm attack (dino_reborn) using Adspect cloaking to hide behind a fake crypto CAPTCHA for victims, while showing a polished decoy site (Offlido) to researchers.