Two security researchers, operating under the pseudonyms BobDaHacker and BobTheShoplifter, have claimed to uncover “catastrophic” vulnerabilities in the systems of Restaurant Brands International (RBI)—the parent company of Burger King, Tim Hortons, and Popeyes, which...
A critical vulnerability, CVE-2025-42957, has been identified in SAP S/4HANA, carrying a near-maximum CVSS score of 9.9. The flaw enables users with only minimal privileges to execute arbitrary code, effectively granting them full control...
On August 20, Apple released an unscheduled security update for all major platforms—iOS, iPadOS, macOS, and others. The patch addresses CVE-2025-43300, a buffer overflow vulnerability in the ImageIO framework, by enforcing stricter boundary checks...
PortSwigger researcher Gareth Hayes has unveiled a novel technique for stealing data directly from HTML attributes using inline CSS, without relying on selectors or external style sheets. The discovery was made possible by the...
Researchers at Eclypsium have recorded a sharp increase in scanning activity targeting outdated and long-abandoned network equipment. The chief danger lies in the fact that many of these attacks are being launched from already-compromised...
Artificial intelligence systems have often been criticized for producing convoluted vulnerability reports and overwhelming open-source developers with irrelevant complaints. Yet researchers from Nanjing University and the University of Sydney have presented a striking counterexample:...
TP-Link has confirmed the existence of a new zero-day vulnerability affecting several of its router models. The flaw was first identified by an independent security researcher operating under the alias Mehrun (ByteRay), who reported...
On underground forums, cybercriminals have claimed they have begun deploying HexStrike AI—a new open-source penetration testing tool—against Citrix NetScaler vulnerabilities just hours after they were publicly disclosed. The news was reported by Check Point...
Android has released its most extensive patch bundle of the year, outpacing the traditional “Patch Tuesday” cycle. In response to reports of active exploitation of two vulnerabilities, the system received 120 fixes at once...
On September 3, 2025, researcher Youfu Zhang reported to the Mozilla dev-security-policy mailing list that the certification authority Fina RDC 2020 had issued multiple TLS certificates for the IP address 1.1.1.1. This address, jointly...
Mandiant researchers have uncovered an attack targeting legacy installations of the Sitecore platform. The attackers exploited a demonstration ASP.NET key that had been publicly included in official documentation until 2017. This flaw, tracked as...
Researchers at Armis Labs have uncovered ten severe vulnerabilities in Copeland’s E2 and E3 industrial controllers, widely deployed by the world’s largest retail chains and cold storage providers. These devices manage refrigeration systems, HVAC,...
