Security researchers have disclosed a .NET vulnerability that could affect a wide range of enterprise products and lead to remote code execution. The issue stems from how Microsoft .NET–based applications process SOAP messages, and,...
Attackers are actively exploiting a newly discovered zero-day vulnerability in Gogs—a widely used self-hosted Git service—for which no official patch has yet been released. According to Wiz, the ongoing campaign has already compromised more...
Google has released an unscheduled Chrome update to patch a zero-day vulnerability already being exploited in active attacks. The fix is included in stable build 143.0.7499.110 for Windows and macOS, and 143.0.7499.109 for Linux....
Microsoft has released its December security updates: Patch Tuesday brings fixes for 57 vulnerabilities, including three zero-days (one of which is already being actively exploited) and three critical remote-code-execution flaws. Administrators and Windows users...
A newly discovered vulnerability in Node.js, designated CVE-2025-55182 and informally dubbed React2Shell, has become a favored weapon of botnets within mere days of its disclosure. Operators are now launching widespread attacks against vulnerable web...
A researcher known under the pseudonym Vulndisclosure has reported a vulnerability, dubbed ZeroBoot, that enables an attacker to bypass file-based encryption (FBE) on the Samsung Galaxy A25 5G and access user data without entering...
In February, a Slovenian information security researcher published an analysis of the Chinese remote-management device NanoKVM, revealing that the inexpensive €30–60 KVM kit shipped with a host of vulnerabilities—along with a concealed microphone that...
Estonian security researcher Lira Rebane has unveiled an unconventional clickjacking technique that hinges on a fusion of SVG graphics and cascading style sheets. Her talk at BSides Tallinn in October passed largely unnoticed by...
Hacker groups have exploited a security gap in Array AG Series corporate gateways, implanting covert management micro-programs and creating fraudulent user accounts without the administrator’s knowledge. The flaw, tracked as CVE-2025-66644, enabled arbitrary command...
On 4 December 2025, the Apache Software Foundation disclosed a critical vulnerability — CVE-2025-66516, rated the maximum CVSS 10.0 — in the Apache Tika library. Because Tika underpins search engines, ECM platforms, DLP systems,...
More than thirty vulnerabilities have been uncovered in popular AI-enhanced development environments, all of which allow attackers — through a combination of prompt injections and legitimate IDE capabilities — to silently exfiltrate data or...
Two China-linked hacking groups began exploiting a critical vulnerability in React Server Components just hours after it became public. The flaw — CVE-2025-55182, rated a maximum 10 — has already been dubbed React2Shell and...
