In its September Patch Tuesday release, Microsoft delivered a sweeping package of updates, addressing 81 vulnerabilities across its products and services. Among them were nine critical flaws, including two zero-day vulnerabilities, which drew the...
An independent researcher named Alexander Popov has unveiled a novel exploitation technique for a critical Linux kernel vulnerability, identified as CVE-2024-50264. This use-after-free flaw in the AF_VSOCK subsystem has existed since kernel version 4.8...
A newly disclosed vulnerability in the HTTP/2 protocol, dubbed MadeYouReset (CVE-2025-8671), was revealed on August 13, 2025. The flaw allows an attacker to send specially crafted protocol frames that force the server to repeatedly...
A critical vulnerability has been identified in Apache Jackrabbit, exposing systems to remote code execution and the potential compromise of corporate infrastructure. Tracked as CVE-2025-58782, the flaw impacts two key components — Jackrabbit Core...
Two security researchers, operating under the pseudonyms BobDaHacker and BobTheShoplifter, have claimed to uncover “catastrophic” vulnerabilities in the systems of Restaurant Brands International (RBI)—the parent company of Burger King, Tim Hortons, and Popeyes, which...
A critical vulnerability, CVE-2025-42957, has been identified in SAP S/4HANA, carrying a near-maximum CVSS score of 9.9. The flaw enables users with only minimal privileges to execute arbitrary code, effectively granting them full control...
On August 20, Apple released an unscheduled security update for all major platforms—iOS, iPadOS, macOS, and others. The patch addresses CVE-2025-43300, a buffer overflow vulnerability in the ImageIO framework, by enforcing stricter boundary checks...
PortSwigger researcher Gareth Hayes has unveiled a novel technique for stealing data directly from HTML attributes using inline CSS, without relying on selectors or external style sheets. The discovery was made possible by the...
Researchers at Eclypsium have recorded a sharp increase in scanning activity targeting outdated and long-abandoned network equipment. The chief danger lies in the fact that many of these attacks are being launched from already-compromised...
Artificial intelligence systems have often been criticized for producing convoluted vulnerability reports and overwhelming open-source developers with irrelevant complaints. Yet researchers from Nanjing University and the University of Sydney have presented a striking counterexample:...
TP-Link has confirmed the existence of a new zero-day vulnerability affecting several of its router models. The flaw was first identified by an independent security researcher operating under the alias Mehrun (ByteRay), who reported...
On underground forums, cybercriminals have claimed they have begun deploying HexStrike AI—a new open-source penetration testing tool—against Citrix NetScaler vulnerabilities just hours after they were publicly disclosed. The news was reported by Check Point...
