An Important DoS flaw (CVE-2025-64775) in Apache Struts 2 risks server crashes. Improper cleanup of multipart request files leads to disk exhaustion. Update to v6.8.0 or v7.1.1 immediately.

Zoom Rooms patched two flaws: a High-severity (CVSS 7.8) LPE flaw in Windows via downgrade bypass and information disclosure in macOS. Update to v6.6.0 immediately to prevent unauthenticated access.

Google has pushed an urgent security update to the Stable Channel for Desktop, racing to patch a high-severity vulnerability that is currently being exploited in the wild. The release, which bring…

Jenkins patched nine flaws: a High-severity unauthenticated DoS (CVE-2025-67635) via HTTP CLI and XSS via Coverage Plugin. Build tokens are now encrypted. Update to v2.541 immediately.

A Gogs zero-day (CVE-2025-8110) bypasses a previous patch, enabling RCE via symlink path traversal. Over 50% of exposed instances are compromised, deploying the Supershell C2. Disable open registration immediately.

A High-severity XSS (CVSS 8.7) flaw in GitLab Wiki allows session hijack via malicious pages, enabling unauthorized actions. Other HTML Injection flaws patched. Self-managed admins must update to v18.6.2.

Meta rolls out a transparent Facebook redesign for better navigation. Meanwhile, Instagram is secretly using AI to generate "content-farm" titles in code to boost Google SEO.

SpaceX is planning a record-shattering IPO in 2026/2027 to raise over $30B, targeting a $1.5T valuation. Proceeds will fund Mars ambitions and orbital AI data centers.

China-nexus WARP PANDA APT targets VMware/Azure with BRICKSTORM, a Golang backdoor using DoH for stealth. The group creates "ghost VMs" and conducts session replay attacks for long-term espionage.

A critical unpatched flaw in the TOTOLINK AX1800 router allows unauthenticated HTTP requests to enable Telnet for root RCE. Admins must block WAN access immediately as there is no official fix.

FBI/CISA warn pro-Russia hacktivists (CARR, NoName057) are targeting critical infrastructure with unsophisticated attacks. They exploit unsecured VNC connections to manipulate HMIs and cause physical damage.

CISA warned of a Critical (CVSS 9.4) flaw in D-Link DCS-F5614-L1 cameras. Missing Authentication allows attackers to bypass login, steal admin credentials, and hijack video feeds. Patch immediately.

A Critical RCE (CVSS 10.0) flaw, React2Shell, in React/Next.js's Flight protocol allows unauthenticated system takeover. North Korean and Chinese state actors are actively exploiting the deserialization bug.

Makop ransomware operators now use GuLoader and BYOVD (ThrottleStop.sys) to bypass EDR and security. The "low-effort" campaign targets RDP-exposed networks, with 55% of attacks aimed at India.

DeadLock Ransomware uses BYOVD (Baidu driver exploit) and the EDRGay.exe loader to kill EDR/AV at the kernel level. It uses a custom stream cipher and deletes shadow copies to prevent recovery.

This article is a walkthrough guide to solving the challenges in the Google XSS Game on Appspot.

Despite years of warnings, “123456” and “password” remain among the most common passwords. In an age of billion-record data breaches, weak…

Artificial Intelligence (AI) has revolutionized every industry, and cybersecurity is no exception. In 2025, we are witnessing a digital…

The $800 Parameter: How One Unsanitized Input Revealed a Global Security Gap

CRITICAL FINDING! Massive leaked merchant emails along with client IDs in public PayPal SDK URL. A major PII data leak.