Google has released an unscheduled Chrome update to patch a zero-day vulnerability already being exploited in active attacks. The fix is included in stable build 143.0.7499.110 for Windows and macOS, and 143.0.7499.109 for Linux....
Microsoft has released its December security updates: Patch Tuesday brings fixes for 57 vulnerabilities, including three zero-days (one of which is already being actively exploited) and three critical remote-code-execution flaws. Administrators and Windows users...
The financially motivated group Storm-0249, long known as a broker of initial access for ransomware operators, has markedly refined its tradecraft, triggering a new wave of alarm among cybersecurity professionals. Analysts at ReliaQuest have...
A newly discovered vulnerability in Node.js, designated CVE-2025-55182 and informally dubbed React2Shell, has become a favored weapon of botnets within mere days of its disclosure. Operators are now launching widespread attacks against vulnerable web...
DllShimmer Weaponize DLL hijacking easily. Backdoor any function in any DLL without disrupting normal process operation. How it works DllShimmer parses the original DLL and extracts information about exported functions (name, ordinal number, and...
DumpGuard is a credential dumping tool that can extract the NTLMv1 hashes of users on modern Windows systems. The tool relies on the Remote Credential Guard protocol, and allows credential dumping even when Credential Guard is enabled on...
Researchers from Howler Cell have detailed an underground marketplace for compromised websites operated by students and freelancers across Asia. At the center of their latest report is a cybersecurity student from Bangladesh who aspires...
A data leak at the Chinese company Knownsec—long heralded as one of the flagships of the nation’s cybersecurity industry—has dealt the firm a reputational blow and forced an unexpected admission of internal weaknesses. In...
A researcher known under the pseudonym Vulndisclosure has reported a vulnerability, dubbed ZeroBoot, that enables an attacker to bypass file-based encryption (FBE) on the Samsung Galaxy A25 5G and access user data without entering...
A ransomware attack has crippled the operations of several key Puerto Rican government agencies, yet officials have still not publicly acknowledged the incident. According to available information, beginning on 25 November, three major public...
In February, a Slovenian information security researcher published an analysis of the Chinese remote-management device NanoKVM, revealing that the inexpensive €30–60 KVM kit shipped with a host of vulnerabilities—along with a concealed microphone that...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in its newly issued mobile communications guidelines, has delivered a stark warning to smartphone owners: do not use personal VPN services. The document for iPhone and...