A leaked memo revealed the US Army's NGC2 system had "critical deficiencies," including no RBAC and unverified cloud components, violating Zero Trust principles before testing.

Discord confirmed a breach at a third-party contractor exposed PII, limited payment details, and a small number of government ID images submitted for age verification.

A hacker alliance launched a leak site demanding $989.45M ransom to withhold 1 billion records stolen from Salesforce customers via OAuth token abuse and vishing.

A ZCS zero-day (CVE-2025-27915, CVSS 7.8) was actively exploited since Jan. 2025. Attackers used malicious calendar .ICS files to inject XSS and steal Zimbra webmail credentials.

A Critical (CVSS 9.8) zero-day RCE flaw (CVE-2025-61882) in Oracle E-Business Suite's BI Publisher component is being actively exploited by the Clop group for data theft.

LayerX disclosed CometJacking, a critical flaw that exploits a single crafted link to silently hijack Perplexity Comet’s AI agent, stealing Gmail and Calendar data.

The Confucius APT is actively targeting Pakistani entities with the Anondoor Python backdoor and WooperStealer, using DLL sideloading and sophisticated phishing to ensure long-term espionage.

A critical Unity bug (CVE-2025-59489) exposes games built since Unity 2017.1 to local code execution via argument injection. Developers must recompile and republish their titles.

Infoblox uncovered the Detour Dog campaign, which compromises 30K+ websites and uses covert DNS TXT records for C2 to deliver the StarFish shell and Strela Stealer malware.

OpenAI unveils the Apps SDK, transforming ChatGPT into a powerful “super app” where users can connect apps like Spotify, Canva, and Uber.

OpenAI selected AMD as a "core strategic computing partner," adopting Instinct MI450 GPUs for a 6 GW AI infrastructure. OpenAI can acquire a 10% equity stake in AMD.

OpenAI CEO Sam Altman announced at DevDay that ChatGPT now has 800 million weekly active users, making it the world's most dominant generative AI platform.

The Qt Group patched two critical flaws in Qt SVG: a UAF bug (CVE-2025-10729) that risks RCE, and recursive pattern element (CVE-2025-10728) leading to stack overflow DoS.

Elastic patched five flaws in Kibana/Elasticsearch, including three Critical XSS issues (CVE-2025-25009) and credential leaks, urging immediate upgrades to v8.18.8+.

CrowdStrike warns that the Critical RCE zero-day (CVE-2025-61882) in Oracle E-Business Suite is being actively exploited by GRACEFUL SPIDER (Clop affiliate) for corporate data theft. Patch immediately.

A Critical (CVSS 9.7) DNS rebinding flaw (CVE-2025-59159) in the SillyTavern LLM interface allows remote attackers to seize full control of local AI instances and steal API keys.

A Critical (CVSS 10.0) zero-day RCE flaw (CVE-2025-10035) in GoAnywhere MFT is being actively exploited by the Medusa ransomware group, Storm-1175. Patch immediately.

IBM patched a Critical (CVSS 9.3) LPE flaw (CVE-2025-36356) in Verify Access/Identity Access that allows locally authenticated users to escalate privileges to root. Update to v10.0.9.0-IF3 now.

Rapid7 exposed the unauthenticated RCE chain in Cisco ASA/FTD. CVE-2025-20362 bypasses auth to reach CVE-2025-20333, a buffer overflow in the WebVPN Lua script. Patch immediately.

A critical UAF flaw in the Linux Traffic Control subsystem (CVE-2023-4921, CVSS 7.8) allows local privilege escalation to root. A fully detailed PoC exploit has been released.