Google expanded Android's call-scam protection. It detects suspicious calls while financial apps are open, triggering a 30-second mandatory pause for users.

Russia imposed a network-level blockade on Apple's encrypted FaceTime service, citing its alleged use for coordinating fraud and terrorist attacks, making the app unusable.

Apache HTTP Server 2.4.66 patched five flaws. Key fixes include a moderate SSRF flaw (CVE-2025-59775) that risks NTLM hash leakage on Windows, and a mod_userdir/suexec bypass. Update immediately.

ASEC exposed PrintMiner, a Monero cryptominer spreading via USB LNK files. It uses DLL Side-Loading (printui.exe) and "Smart Mining" to suspend activity when games or Task Manager are opened.

Apache patched a Catastrophic XXE flaw (CVE-2025-66516, CVSS 10.0) in Tika Core. The bug is exploitable via malicious XFA data inside a PDF, risking server-side data disclosure and RCE. Update immediately.

Amazon exposed Chinese APTs exploiting the React2Shell zero-day (CVE-2025-55182, CVSS 10.0) hours after disclosure. Earth Lamia and Jackpot Panda are actively targeting unpatched Next.js servers for reconnaissance.

SEQRITE exposed Operation DUPEHIKE targeting Russian HR with a malicious LNK bonus lure. The DUPERUNNER implant uses PowerShell and process injection into explorer.exe to deploy the Adaptix C2 Beacon.

A High-severity flaw (CVSS 8.0) in Splunk Enterprise/Universal Forwarder for Windows allows low-privileged users to access/tamper with sensitive installation directories due to incorrect permissions. Update to v10.0.2+.

A High-severity RCE flaw (CVE-2025-66399) in Cacti allows authenticated attackers to execute commands by injecting newline characters into the SNMP Community String. Update to v1.2.29 immediately.

Sekoia exposed Russian Calisto APT (FSB-linked) targeting RSF and NGOs with spear-phishing. The attack uses a custom AiTM kit and a "missing file" lure to steal credentials and 2FA codes.

NVIDIA patched two high-severity DoS flaws in Triton Inference Server (CVE-2025-33211, CVE-2025-33201). Attackers can crash the server by sending malformed or excessively large payloads. Update to r25.10 immediately.

Patchwork APT deployed StreamSpy, a new trojan that uses WebSocket for covert C2 and HTTP for file transfer, blending malicious activity with web traffic to evade detection during espionage operations.

Microsoft reportedly slashed enterprise AI sales quotas by up to 50% after teams struggled to meet targets for platforms like Azure and Microsoft Foundry.

Bug bounty hunting is wild sometimes. One minute you’re casually poking around, and the next you’ve slipped straight into a company’s…

You know that moment in bug bounty hunting when you’re not even expecting anything big… and then suddenly you’re staring at an admin panel…

Some vulnerabilities exist not because of complex bugs…  …but because developers trust the user far more than they should.

📥 HTTP Response Headers: A Detailed Look

The provided text is an introduction to the Resource Timing API, a JavaScript feature used for diagnosing web page performance.

A safe VAPT case study showing how authentication misconfigurations are discovered, abused conceptually, and fixed with secure patterns.

If you’ve ever watched a hacker poke a website, you’ll notice something magical:  they almost always try to open files they were never…

بسم الله الرحمن الرحيم