XDSpy, a covert cyber-espionage group, is back with a sophisticated campaign targeting governments, leveraging an obscure Windows LNK file parsing flaw and new XDigo malware

In today’s connected world, every device you use relies on invisible rules to talk to each other seamlessly. These rules are known as…

Public Wi-Fi is everywhere — in cafes, airports, malls, and hotels. It’s convenient, fast, and free. But behind the ease lies a serious cybersecurity risk that most people don’t even think about…

DevOps + Cloud Security Blog Series by Angie

If “one minute equals money,” consider this: unplanned downtime now costs smaller firms about $427 per minute. For growth-minded companies…

Introduction

My time at HP marked a before-and-after in my professional life. I had the privilege of working with brilliant minds in both Puerto Rico…

By Aditiya Widodo Putra, Cybersecurity & Blockchain Consultant

⚠️ On June 5, 2025, Google confirmed a critical zero-day vulnerability in Chrome that could let attackers hijack your device just by…

When I set out to build HavenAI Secure, I wasn’t just creating another AI demo. I was solving a real problem I’d felt firsthand in security…

In today’s hyper-connected world, social media platforms have become powerful tools for communication and information sharing, and for more…

Securing Large Language Models in the Wild

YouTube CEO Neal Mohan announced Veo 3 AI integration into Shorts this summer, enabling text-to-video creation.

iOS 26 introduces direct eSIM transfer to Android, simplifying cross-platform migration and eliminating the need for carrier intervention.

Two flaws in Versa Director SD-WAN allow authenticated RCE via insecure file uploads and privilege escalation via webhook abuse. PoC code is public.

A critical flaw (CVE-2025-24288, CVSS 9.8) in Versa Director exposes hardcoded default credentials for high-privilege accounts with sudo access. PoC released. Update now

Cisco ClamAV versions 1.4.3 and 1.0.9 fix critical flaws: CVE-2025-20260 (CVSS 9.8) in PDF scanning could allow RCE, and CVE-2025-20234 (UDF) leads to DoS.

A critical flaw (CVE-2025-5071) in WordPress's AI Engine plugin allows subscribers to escalate privileges and take over websites with Dev Tools/MCP enabled.

Cisco warns of a critical flaw (CVE-2025-20271, CVSS 8.6) in Meraki MX/Z Series devices, allowing unauthenticated remote DoS on AnyConnect VPN. Update firmware now!

picoCTF Web Exploitation: SSTI2