One of the key defensive barriers against the creation of fake online accounts has proven alarmingly fragile—capable of being bypassed for just a few cents. Researchers at the University of Cambridge have found that...
Freedom Chat, an application marketed as a secure messaging platform, has been exposed to serious risk following the discovery of two critical vulnerabilities. Despite assurances of data privacy—including the concealment of users’ phone numbers—researchers...
A critical vulnerability in the widely used JavaScript library React, dubbed React2Shell, is already being exploited at scale. According to Google, at least five newly identified Chinese espionage groups, “Iran-linked” threat actors, and common...
A tool has been released into the public domain that enables covert monitoring of user activity on WhatsApp and Signal using nothing more than a phone number. This surveillance technique spans more than three...
Apple has released out-of-band patches addressing two zero-day vulnerabilities that were already being exploited in real-world attacks. The company confirmed that the exploits involved highly sophisticated technical techniques targeting a limited set of individuals,...
The 0patch team has reported that while analyzing CVE-2025-59230 in the Windows Remote Access Connection Manager (RasMan)—a flaw Microsoft addressed with its October 2025 updates—researchers uncovered a working exploit that enables local code execution...
The long-running React2Shell saga—which has continued to disrupt many web projects—has taken another turn: it has emerged that the original fix was incomplete. A deeper review uncovered two additional vulnerabilities in the React Server...
A newly discovered flaw in the Windows Remote Access Connection Manager (RasMan) service allows the operating system to be disrupted without administrative privileges. A free, unofficial fix is already available, while Microsoft prepares its...
Gladinet is facing fresh trouble once again: vulnerabilities have been uncovered in its CentreStack and Triofox products stemming from embedded, hardcoded cryptography. According to Huntress, the AES implementation relies on fixed keys, allowing attackers...
Notepad++ has released version 8.8.9 to remediate a weakness in its WinGUp (GUP.exe) update mechanism. Researchers and users had reported incidents in which the updater, instead of fetching a legitimate installer, downloaded and executed...
Immediately following the public disclosure of a critical vulnerability in React Server Components, threat actors began exploiting it in attacks against organizations across multiple industries. The Huntress team reports that the flaw is an...
The emergence of a new malicious tool within the React2Shell attack chain has become a notable development amid the surge of compromises that followed the disclosure of CVE-2025-55182. This time, the activity goes far...
