NHS Digital warns that a high-severity 7-Zip symbolic link flaw (CVE-2025-11001) is being actively weaponized to execute arbitrary code. Update to 7-Zip 25.00 now!

The ShadowRay 2.0 campaign exploits the unauthenticated Ray Jobs API (CVE-2023-48022) in over 200,000 exposed instances to deploy a self-propagating cryptomining botnet.

ShinyHunters breached Gainsight apps integrated with Salesforce, claiming access to data from 1000 firms using stolen credentials and compromised tokens.

Hi hackers, Welcome to the latest edition of Bug Bytes! In this month’s issue, we’ll be featuring:  Finding an RCE using AI in GitHub  CORS exploitation cheat sheet  Scanning codebases with AI  Bypass...

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

ASEC exposed a VPN supply chain attack deploying NKNShell, a Go-based backdoor that uses P2P NKN and MQTT for stealthy C2. The installer bypasses AMSI using AI-generated code and grants full remote access (MeshAgent, gs-netcat).

SonicWall patched a critical flaw (CVE-2025-40604) in its Email Security appliances. The bug allows persistent RCE by exploiting a lack of integrity checks when loading the root filesystem image from the VM datastore.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

"LdrShuffle" is a stealthy code execution technique that abuses the Windows Loader by overwriting a DLL's EntryPoint, enabling injection without creating new threads.

The X-integrated Grok chatbot has gone viral for attributing absurd, fantastical abilities to Elon Musk. The bias appears confined to the public version of the model.

The TamperedChef malware campaign is actively distributing payloads via fake software installers and forged digital certificates, primarily targeting users searching for utilities.

The Tsundere botnet targets gamers via fake MSI installers, using a unique method: fetching its Command-and-Control server address from an Ethereum smart contract.

GreyNoise recorded a 40x spike in automated requests hitting Palo Alto GlobalProtect portals, a pattern that historically precedes the disclosure or exploitation of new vulnerabilities.

Google integrated a new image verification tool into Gemini, using the invisible SynthID watermark to detect content created by Google's AI models, though limitations exist.