Cisco patches a Critical 9.9 zero-day (CVE-2025-20333) in ASA/FTD VPN web servers. Authenticated attackers can exploit the flaw for root-level Remote Code Execution.

Cisco disclosed a Critical RCE flaw in its Firewall ASA/FTD, IOS, IOS XE, and IOS XR web services. Unauthenticated attackers can gain root access.

Malicious Rust crates, downloaded 8,400+ times, were found to be typosquatting legitimate libraries to scan source code and steal Solana and Ethereum private keys.

Cisco patches CVE-2025-20362, a medium-high zero-day vulnerability in ASA/FTD VPN web servers that is being exploited to gain unauthorized access to restricted resources.

Apache Airflow 3.0.3 has a bug (CVE-2025-54831) exposing sensitive connection details, including passwords, to all users with only READ permissions. Update immediately.

GTIG reveals BRICKSTORM, a stealthy Go backdoor linked to China-nexus UNC5221, targeting US legal/SaaS firms to steal IP and establish long-term espionage access.

GitLab urges immediate upgrade to patch versions 18.4.1+ for high-severity DoS flaws that allowed unauthenticated attackers to crash self-managed instances.

NVIDIA released an urgent update for its Megatron-LM LLM framework, patching four high-severity code injection flaws that could allow attackers to compromise AI workflows.

Microsoft blocked a credential phishing campaign that used AI to generate complex, verbose code in an SVG file to obfuscate its payload and evade defenses.

The Lone None group uses fake copyright notices to deliver a new stealer malware that focuses on crypto theft via clipboard replacement and utilizes Telegram for C2.

A vulnerability dubbed "LNK Stomping" (CVE-2024-38217) is actively used to strip the 'Mark of the Web' from LNK files, bypassing Windows security policies.

Discover powerful alternatives and complementary tools that most security testers overlook but can dramatically improve your bug hunting…

Hello everyone, I’m Firda Nurelia (find me on LinkedIn). Today I’m sharing a critical Stored Cross-Site Scripting (XSS) I found that…

Recently, the JavaScript community has been shaken by a series of supplychain attacks. These are not bugs in code we wrote, but malicious…

Introduction

From AI Fear to Terms of Service: A Security Professional’s Reality Check The cybersecurity community’s relationship with AI has shifted dramatically from existential dread to practical …

In cybersecurity, patching has long been positioned as a simple equation: vulnerabilities are discovered, patches are released, and…

A drone can have a strong body and a powerful energy source, but without a brain, it’s just a shell. The flight controller is that brain…

Hello, this is Penta Security.

안녕하세요. 펜타시큐리티입니다.