The Xubuntu download page was compromised via a WordPress brute-force attack, leading to the distribution of a malicious file for four days. The site is now secured.

Sturnus is a new Android banking trojan that captures decrypted Signal/WhatsApp messages, performs overlay attacks, and uses VNC for full, remote device takeover.

The MEMINSPECT mechanism has been proposed for the Linux kernel to simplify memory analysis in constrained systems, enabling reduced post-mortem memory dumps.

Google unilaterally enabled Quick Share/AirDrop interoperability on the Pixel 10, allowing seamless two-way file transfers with iPhones and Macs. The future of sharing is here!

"BitlockMove" PoC demonstrates a novel lateral movement technique abusing BitLocker DCOM/COM hijacking to execute code in a logged-in user's session without credential theft.

AMD is adding support for mysterious new GPUs (GFXHUB 12.1) to the Linux driver, suggesting either a refined RDNA 4 design or the unannounced next-gen RDNA 5/UDNA architecture.

Sysmon capabilities are now natively integrated into Windows 11 and Server 2025, providing built-in security telemetry for process and network monitoring via Windows Update.

Operation WrtHug compromised over 50,000 outdated ASUS routers (RT-AC, DSL-AC series) using old flaws to build a covert botnet, likely linked to Chinese threat actors.

Fortinet confirms a new, actively exploited command injection flaw (CVE-2025-58034) in FortiWeb, which CISA mandates be patched within 7 days. Update immediately!

NHS Digital warns that a high-severity 7-Zip symbolic link flaw (CVE-2025-11001) is being actively weaponized to execute arbitrary code. Update to 7-Zip 25.00 now!

The ShadowRay 2.0 campaign exploits the unauthenticated Ray Jobs API (CVE-2023-48022) in over 200,000 exposed instances to deploy a self-propagating cryptomining botnet.

ShinyHunters breached Gainsight apps integrated with Salesforce, claiming access to data from 1000 firms using stolen credentials and compromised tokens.

Hi hackers, Welcome to the latest edition of Bug Bytes! In this month’s issue, we’ll be featuring:  Finding an RCE using AI in GitHub  CORS exploitation cheat sheet  Scanning codebases with AI  Bypass...

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

ASEC exposed a VPN supply chain attack deploying NKNShell, a Go-based backdoor that uses P2P NKN and MQTT for stealthy C2. The installer bypasses AMSI using AI-generated code and grants full remote access (MeshAgent, gs-netcat).

SonicWall patched a critical flaw (CVE-2025-40604) in its Email Security appliances. The bug allows persistent RCE by exploiting a lack of integrity checks when loading the root filesystem image from the VM datastore.