The flaw, dubbed ‘GeminiJack,’ exploits the trust boundary between user-controlled content in data sources and the AI model’s instruction processing
Category: Exploits
Exploits, Global Security News
Warning: WinRAR Vulnerability CVE-2025-6218 Under Active Attack by Multiple Threat Groups
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a security flaw impacting the WinRAR file archiver and compression utility to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2025-6218 (CVSS score: 7.8), is a path traversal bug that could enable code execution. However, for exploitation
Breaking News, CISA, Exploits, Global Security News, hacking, hacking news, Security
U.S. CISA adds Microsoft Windows and WinRAR flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows and WinRAR flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Microsoft Windows and WinRAR flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: CVE-2025-6218 (CVSS score of 7.8) RARLAB WinRAR Path Traversal…
Exploits, Global Security News
Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit and Two Zero-Days
Microsoft closed out 2025 with patches for 56 security flaws in various products across the Windows platform, including one vulnerability that has been actively exploited in the wild. Of the 56 flaws, three are rated Critical, and 53 are rated Important in severity. Two other defects are listed as publicly known at the time of…
Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, Security
Microsoft Patch Tuesday security updates for December 2025 fixed an actively exploited zero-day
Microsoft Patch Tuesday security updates for December 2025 address 57 vulnerabilities, including three critical flaws. Microsoft Patch Tuesday security updates for December 2025 addressed 57 vulnerabilities in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Exchange Server, Azure, Copilot, PowerShell, and Windows Defender. Three vulnerabilities are rated Critical, while the rest are…
Exploits, Global Security News
Fortinet, Ivanti, and SAP Issue Urgent Patches for Authentication and Code Execution Flaws
Fortinet, Ivanti, and SAP have moved to address critical security flaws in their products that, if successfully exploited, could result in an authentication bypass and code execution. The Fortinet vulnerabilities affect FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager and relate to a case of improper verification of a cryptographic signature. They are tracked as CVE-2025-59718 and
Exploits, Global Security News
GitHub Action Secrets aren’t secret anymore: exposed PATs now a direct path into cloud environments
Many enterprises use GitHub Action Secrets to store and protect sensitive information such as credentials, API keys, and tokens used in CI/CD workflows. These private repositories are widely assumed to be safe and locked down. But attackers are now exploiting that blind trust, according to new research from the Wiz Customer Incident Response Team. They…
Exploits, Global Security News, Security, Security Software, Threat and Vulnerability Management, Vulnerabilities, Zero-Day Vulnerabilities
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited
Microsoft is finishing 2025 by issuing only 57 patches for Windows and other products for December Patch Tuesday, but one vulnerability is already being exploited as a zero day and needs to be addressed fast. It’s an escalation of privilege vulnerability in Windows Cloud Files Mini Filter Driver (CVE-2025-62221), described as a use-after-free problem in…
Exploits, Global Security News, Latest Warnings, The Coming Storm, Time to Patch
Microsoft Patch Tuesday, December 2025 Edition
Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already being exploited, as well as two publicly disclosed vulnerabilities. Despite releasing a lower-than-normal number of security updates these past few months, Microsoft patched…
Exploits, Global Security News
Microsoft Fixes Exploited Zero Day in Light Patch Tuesday
Proof-of-concept exploit code is publicly available for two other flaws in this month’s Patch Tuesday. In total, the company issued patches for more than 1,150 flaws this year.
Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, Security
Ivanti warns customers of new EPM flaw enabling remote code execution
Ivanti warns users to address a newly disclosed Endpoint Manager vulnerability that could let attackers execute code remotely. Software firm Ivanti addressed a newly disclosed vulnerability, tracked as CVE-2025-10573 (CVSS score 9.6), in its Endpoint Manager (EPM) solution. The vulnerability is a Stored XSS that could allow a remote unauthenticated attacker to execute arbitrary “Stored…
AI, Artificial Intelligence, Cybersecurity, deepfakes, Exploits, Global Security News
Organizations can now buy cyber insurance that covers deepfakes
Synthetic media, including AI-generated deepfake audio and video, has been increasingly leveraged by criminals, scammers and spies to deceive individuals and businesses. Sometimes they do so by imitating an employee’s CEO, urging them to transfer large sums of money or provide them access to work accounts. Other times this fake media is created by a…
Cybersecurity, Cybersecurity and Infrastructure Security Agency (CISA), Exploits, Global Security News, known exploited vulnerabilities (KEV), Technology, Threats
Microsoft’s last Patch Tuesday of 2025 addresses 57 defects, including one zero-day
Microsoft addressed 57 vulnerabilities affecting its various products for business operations and core systems, including one actively exploited zero-day, the company said in its latest monthly security update. The zero-day vulnerability — CVE-2025-62221 — affects the Windows Cloud Files Mini Filter Driver and has a CVSS rating of 7.8. Attackers could exploit the use-after-free defect…
Exploits, Global Security News
Microsoft Patch Tuesday December 2025, (Tue, Dec 9th)
This release addresses 57 vulnerabilities. 3 of these vulnerabilities are rated critical. One vulnerability was already exploited, and two were publicly disclosed before the patch was released. CVE-2025-62221: This privilege escalation vulnerability in the Microsoft Cloud Files Mini Filters driver is already being exploited. CVE-2025-54100: A PowerShell script using Invoke-WebRequest may execute scripts that are included…
Exploits, Global Security News, Microsoft, Security
Microsoft December 2025 Patch Tuesday fixes 3 zero-days, 57 flaws
Microsoft’s December 2025 Patch Tuesday fixes 57 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. […]
Exploits, Global Security News
North Korea-linked Actors Exploit React2Shell to Deploy New EtherRAT Malware
Threat actors with ties to North Korea have likely become the latest to exploit the recently disclosed critical security React2Shell flaw in React Server Components (RSC) to deliver a previously undocumented remote access trojan dubbed EtherRAT. “EtherRAT leverages Ethereum smart contracts for command-and-control (C2) resolution, deploys five independent Linux persistence mechanisms, and
Exploits, Global Security News
React2Shell Exploit Campaigns Tied to North Korean Cyber Intrusion Tactics
Sysdig has found sophisticated malicious campaigns exploiting React2Shell that delivered EtherRAT and suggested North Korean hackers’ involvement
Exploits, Global Security News
Going deeper into layer zero: must-know for the cyber industry insiders
Several months ago, I proposed a concept that helps explain how our industry works and what the prerequisites are for a startup to become a billion-dollar company. I called this concept a “layer zero” because it is the foundation upon which everything else gets built. That article got a fantastic response and I’ve had tens…
AI, Android, android security, Apps, Exploits, Global Security News, privacy, Risk Management
Further Hardening Android GPUs
Posted by Liz Prucka, Hamzeh Zawawy, Rishika Hooda, Android Security and Privacy Team Last year, Google’s Android Red Team partnered with Arm to conduct an in-depth security analysis of the Mali GPU, a component used in billions of Android devices worldwide. This collaboration was a significant step in proactively identifying and fixing vulnerabilities in the…
AI, Android, android security, Apps, Exploits, Global Security News, privacy, Risk Management
Further Hardening Android GPUs
Posted by Liz Prucka, Hamzeh Zawawy, Rishika Hooda, Android Security and Privacy Team Last year, Google’s Android Red Team partnered with Arm to conduct an in-depth security analysis of the Mali GPU, a component used in billions of Android devices worldwide. This collaboration was a significant step in proactively identifying and fixing vulnerabilities in the…
Breaking News, cyber crime, Cybercrime, Exploits, Global Security News, malware
Broadside botnet hits TBK DVRs, raising alarms for maritime logistics
Mirai-based Broadside botnet targets vulnerable TBK Vision DVRs, posing a potential threat to the maritime logistics sector, Cydome warns. Cydome researchers have identified a new Mirai botnet variant dubbed Broadside that is targeting the maritime logistics sector by exploiting the command injection vulnerability CVE-2024-3721 in TBK DVR devices used on vessels. “Cydome’s Cybersecurity Research Team has identified…
Exploits, Global Security News
Google Adds Layered Defenses to Chrome to Block Indirect Prompt Injection Threats
Google on Monday announced a set of new security features in Chrome, following the company’s addition of agentic artificial intelligence (AI) capabilities to the web browser. To that end, the tech giant said it has implemented layered defenses to make it harder for bad actors to exploit indirect prompt injections that arise as a result…
Exploits, Global Security News
Apache Tika hit by critical vulnerability thought to be patched months ago
A security flaw in the widely-used Apache Tika XML document extraction utility, originally made public last summer, is wider in scope and more serious than first thought, the project’s maintainers have warned. Their new alert relates to two entwined flaws, the first CVE-2025-54988 from August, rated 8.4 in severity, and the second, CVE-2025-66516 made public…
Breaking News, cyber crime, Cybercrime, Exploits, fbi, Global Security News, Security
FBI: Crooks manipulate online photos to fuel virtual kidnapping ransoms
The FBI warns of criminals altering images shared on social media and using them as fake proof of life photos in virtual kidnapping ransom scams. The FBI warns that criminals are altering publicly available photos to create fake “proof-of-life” images used in virtual kidnapping scams, posing as kidnappers and demanding ransom. “The Federal Bureau of…
AI, API security, Apps, Endpoint, Exploits, Global Security News
Update on React Server Components RCE Vulnerability (CVE-2025-55182 / CVE-2025-66478)
The attack landscape has been dynamic following the disclosure of the React Server Components RCE vulnerability. New information has emerged regarding the initial Proof-of-Concept exploit, as well as improved detection methods, exploitation mechanics observed in the wild, and rapidly growing attack activity. This update summarizes the changes and observations we have made across Wallarm customers.…
AI, API security, Apps, Endpoint, Exploits, Global Security News
Update on React Server Components RCE Vulnerability (CVE-2025-55182 / CVE-2025-66478)
The attack landscape has been dynamic following the disclosure of the React Server Components RCE vulnerability. New information has emerged regarding the initial Proof-of-Concept exploit, as well as improved detection methods, exploitation mechanics observed in the wild, and rapidly growing attack activity. This update summarizes the changes and observations we have made across Wallarm customers.…
AI, API security, Apps, Endpoint, Exploits, Global Security News
Update on React Server Components RCE Vulnerability (CVE-2025-55182 / CVE-2025-66478)
The attack landscape has been dynamic following the disclosure of the React Server Components RCE vulnerability. New information has emerged regarding the initial Proof-of-Concept exploit, as well as improved detection methods, exploitation mechanics observed in the wild, and rapidly growing attack activity. This update summarizes the changes and observations we have made across Wallarm customers.…
AI, API security, Apps, Endpoint, Exploits, Global Security News
Update on React Server Components RCE Vulnerability (CVE-2025-55182 / CVE-2025-66478)
The attack landscape has been dynamic following the disclosure of the React Server Components RCE vulnerability. New information has emerged regarding the initial Proof-of-Concept exploit, as well as improved detection methods, exploitation mechanics observed in the wild, and rapidly growing attack activity. This update summarizes the changes and observations we have made across Wallarm customers.…
AI, API security, Apps, Endpoint, Exploits, Global Security News
Update on React Server Components RCE Vulnerability (CVE-2025-55182 / CVE-2025-66478)
The attack landscape has been dynamic following the disclosure of the React Server Components RCE vulnerability. New information has emerged regarding the initial Proof-of-Concept exploit, as well as improved detection methods, exploitation mechanics observed in the wild, and rapidly growing attack activity. This update summarizes the changes and observations we have made across Wallarm customers.…
AI, API security, Apps, Endpoint, Exploits, Global Security News
Update on React Server Components RCE Vulnerability (CVE-2025-55182 / CVE-2025-66478)
The attack landscape has been dynamic following the disclosure of the React Server Components RCE vulnerability. New information has emerged regarding the initial Proof-of-Concept exploit, as well as improved detection methods, exploitation mechanics observed in the wild, and rapidly growing attack activity. This update summarizes the changes and observations we have made across Wallarm customers.…
AI, API security, Apps, Endpoint, Exploits, Global Security News
Update on React Server Components RCE Vulnerability (CVE-2025-55182 / CVE-2025-66478)
The attack landscape has been dynamic following the disclosure of the React Server Components RCE vulnerability. New information has emerged regarding the initial Proof-of-Concept exploit, as well as improved detection methods, exploitation mechanics observed in the wild, and rapidly growing attack activity. This update summarizes the changes and observations we have made across Wallarm customers.…
AI, API security, Apps, Endpoint, Exploits, Global Security News
Update on React Server Components RCE Vulnerability (CVE-2025-55182 / CVE-2025-66478)
The attack landscape has been dynamic following the disclosure of the React Server Components RCE vulnerability. New information has emerged regarding the initial Proof-of-Concept exploit, as well as improved detection methods, exploitation mechanics observed in the wild, and rapidly growing attack activity. This update summarizes the changes and observations we have made across Wallarm customers.…
Breaking News, cyber crime, data breach, Exploits, Global Security News, hacking
Oracle EBS zero-day used by Clop to breach Barts Health NHS
Clop ransomware stole data from Barts Health NHS after exploiting a zero-day in its Oracle E-Business Suite. Barts Health NHS confirmed that Clop ransomware group stole data by exploiting zero-day CVE-2025-61882 in its Oracle E-Business Suite. The cybercrime group added the organization to its dark web data leak site and leaked the stolen information. The…
APT, Breaking News, Exploits, Global Security News, hacking, intelligence, Security
AWS: China-linked threat actors weaponized React2Shell hours after disclosure
Multiple China-linked threat actors began exploiting the CVE-2025-55182, aka React2Shell flaw, within hours, AWS Security warns. Multiple China-linked threat actors began exploiting the CVE-2025-55182, also known as the React2Shell flaw, within hours, according to AWS Security. The researchers confirmed that this vulnerability doesn’t affect AWS services, however they opted to share threat intelligence data to…
Exploits, Global Security News
⚡ Weekly Recap: USB Malware, React2Shell, WhatsApp Worms, AI IDE Bugs & More
It’s been a week of chaos in code and calm in headlines. A bug that broke the internet’s favorite framework, hackers chasing AI tools, fake apps stealing cash, and record-breaking cyberattacks — all within days. If you blink, you’ll miss how fast the threat map is changing. New flaws are being found, published, and exploited…
Exploits, Global Security News
React2Shell Under Active Exploitation by China-Nexus Hackers
React2Shell (CVE-2025-55182) is under active exploitation by Earth Lamia and Jackpot Panda, risking over two million instances worldwide
Exploits, Global Security News
Sneeit WordPress RCE Exploited in the Wild While ICTBroadcast Bug Fuels Frost Botnet Attacks
A critical security flaw in the Sneeit Framework plugin for WordPress is being actively exploited in the wild, per data from Wordfence. The remote code execution vulnerability in question is CVE-2025-6389 (CVSS score: 9.8), which affects all versions of the plugin prior to and including 8.3. It has been patched in version 8.4, released on…
Breaking News, CISA, Exploits, Global Security News, hacking, hacking news, Security
U.S. CISA adds a Meta React Server Components flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Meta React Server Components flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a a Meta React Server Components flaw, tracked as CVE-2025-55182 (CVSS Score of 10.0), to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is a pre-authentication remote code execution…
Breaking News, cyber crime, Cybercrime, Exploits, Global Security News, malware, Security
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 74
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Analysis of ShadowPad Attack Exploiting WSUS Remote Code Execution Vulnerability (CVE-2025-59287) Shai-Hulud 2.0 Supply Chain Attack: 25K+ npm Repos Exposed Spyware Allows Cyber Threat Actors to Target Users of Messaging Applications Morphisec Thwarts Russian-Linked…
Breaking News, Cybercrime, data breach, Exploits, Global Security News, hacking, Uncategorized
Security Affairs newsletter Round 553 by Pierluigi Paganini – INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Attackers launch dual campaign on GlobalProtect portals and SonicWall APIs Maximum-severity XXE vulnerability discovered in Apache…
Exploits, Global Security News
Critical React2Shell Flaw Added to CISA KEV After Confirmed Active Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday formally added a critical security flaw impacting React Server Components (RSC) to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild. The vulnerability, CVE-2025-55182 (CVSS score: 10.0), relates to a case of remote code execution that could be triggered by…
Exploits, Global Security News
Warning: React2Shell vulnerability already being exploited by threat actors
Plugging the React2Shell vulnerability in the open source React server and Next.js in IT environments has just become even more urgent with reports that exploits are already in the wild. Researchers at Greynoise said today they are seeing “opportunistic, largely automated exploitation attempts” trying to take advantage of the unsafe deserialization vulnerability in React Server…
Cybercrime, Cybersecurity, Exploits, Global Security News, Research, Threats
Attackers hit React defect as researchers quibble over proof
Attackers of different origins and motivations swiftly exploited a critical vulnerability dubbed React2Shell, affecting React Server Components shortly after Meta and the React team publicly disclosed the flaw with a patch Wednesday. Multiple security firms are actively responding to active exploitation in the wild as a scrum of reports conclude the malicious activity is limited…
AI, AI agents, Cybersecurity, Exploits, Global Security News, Technology
More evidence your AI agents can be turned against you
Agentic AI tools are being pushed into software development pipelines, IT networks and other business workflows. But using these tools can quickly turn into a supply chain nightmare for organizations, introducing untrusted or malicious content into their workstream that are then regularly treated as instructions by the underlying large language models powering the tools. Researchers…
Exploits, Global Security News, Healthcare, Security
Barts Health NHS discloses data breach after Oracle zero-day hack
Barts Health NHS Trust has announced that Clop ransomware actors have stolen files from a database by exploiting a vulnerability in its Oracle E-business Suite software. […]
Exploits, Global Security News
Hardening browser security with zero-trust controls
The shift from perimeter-based security to zero trust is now indispensable for combating modern threats. The obsolete “castle-and-moat” model, granting implicit trust to any device or user inside the network, collapsed with the rise of cloud, remote work and BYOD. Attackers now bypass traditional controls by targeting identity, exploiting AI-driven phishing, supply chain intrusions and…
Artificial Intelligence, Exploits, Global Security News
OpenAI prompts AI models to ‘confess’ when they cheat
OpenAI’s research team has trained its GPT-5 large language model to “confess” when it doesn’t follow instructions, providing a second output after its main answer that reports when the model didn’t do as it was told, cut corners, hallucinated, or was uncertain of its answer. “If we can surface when that happens, we can better…
Exploits, Global Security News
AI in CI/CD pipelines can be tricked into behaving badly
AI agents embedded in CI/CD pipelines can be tricked into executing high-privilege commands hidden in crafted GitHub issues or pull request texts. Researchers at Aikido Security have traced the problem back to workflows that pair GitHub Actions or GitLab CI/CD with AI tools such as Gemini CLI, Claude Code Actions, OpenAI Codex Actions or GitHub…
Exploits, Global Security News, Security
Cloudflare blames today’s outage on emergency React2Shell patch
Cloudflare has blamed today’s outage on the emergency patching of a critical React remote code execution vulnerability, which is now actively exploited in attacks. […]
Exploits, Global Security News, Uncategorized
JPCERT/CC Reports Widespread Exploitation of Array Networks AG Gateway Vulnerability
Array Networks AG gateways have been under active exploitation since August 2025 due to a command injection flaw, JPCERT/CC warns. A command injection flaw in Array Networks AG Series gateways, affecting DesktopDirect, has been exploited in the wild since August 2025; it was patched in May 2025. An attacker can exploit the flaw to execute…
Exploits, Global Security News
JPCERT Confirms Active Command Injection Attacks on Array AG Gateways
A command injection vulnerability in Array Networks AG Series secure access gateways has been exploited in the wild since August 2025, according to an alert issued by JPCERT/CC this week. The vulnerability, which does not have a CVE identifier, was addressed by the company on May 11, 2025. It’s rooted in Array’s DesktopDirect, a remote…
Exploits, Global Security News
Coupang breach of 33.7 million accounts allegedly involved engineer insider
A prolonged lack of management of valid authentication keys for signed access tokens issued to authenticators is believed to be the root cause of over 30 million accounts being exposed externally by ecommerce giant Coupang. Ongoing analysis suggests that these keys could have been exploited even after the responsible employee left the company. On Nov.…
Exploits, Global Security News, Security
Hackers are exploiting ArrayOS AG VPN flaw to plant webshells
Threat actors have been exploiting a command injection vulnerability in Array AG Series VPN devices to plant webshells and create rogue users. […]
Amnesty International, Exploits, Geopolitics, Global Security News, privacy, Technology, Threats
Intellexa remotely accessed Predator spyware customer systems, investigation finds
Leaked training videos suggest that Intellexa retained the ability to remotely access the systems of customers who had used its Predator spyware, raising questions about human rights safeguards, according to an investigation published Thursday. That was just one finding from a series of separate but overlapping probes released over the past 24 hours. The training…
Breaking News, CISA, Exploits, Global Security News, hacking, hacking news, Security
U.S. CISA adds a new an OpenPLC ScadaBR flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a new OpenPLC ScadaBR flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an OpenPLC ScadaBR flaw, tracked as CVE-2021-26828 (CVSS Score of 8.7), to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is an unrestricted upload of file with dangerous type vulnerability. “OpenPLC…
Exploits, Global Security News, Security, Security Software, Threat and Vulnerability Management
From feeds to flows: Using a unified linkage model to operationalize threat intelligence
The problem: Static intelligence in a dynamic world Every CISO knows the fatigue that comes with modern threat intelligence. Dozens of vendor feeds pour in daily — STIX packages, IP blocklists, domain indicators, malware hashes — all claiming to help your organization stay one step ahead. Yet most threat feeds still behave like spreadsheets of…
Breaking News, cyber crime, data breach, Exploits, Global Security News, malware, Security
ASUS confirms vendor breach as Everest gang leaks data, claims ArcSoft and Qualcomm
ASUS confirms a third-party breach after Everest leaks sample data. Hackers also claim ArcSoft and Qualcomm. ASUS says a third-party breach exposed data after Everest ransomware leaked samples, claiming they have hacked ASUS, ArcSoft, and Qualcomm. ASUS says a supplier breach exposed some phone camera source code but did not affect products, internal systems, or…
Endpoint Protection, Security, Vulnerabilities, Windows Security, Exploits, Global Security News
Windows shortcuts’ use as a vector for malware may be cut short
A longstanding problem with the way Windows handles LNK shortcut files, which attackers have been abusing for years to hide malicious commands in plain sight, may finally have been fixed, with more than one patch now available to users. The problem was that threat actors could mask a harmful payload in the Target field of…
Enterprise Applications, Privacy, Productivity Software, Security, Exploits, Global Security News
Proton adds encrypted spreadsheets to its expanding productivity suite
Proton has expanded its privacy-focused productivity software suite to include an end-to-end encrypted spreadsheet app. The Swiss software vendor is perhaps best known for its encrypted email service, but has also begun to add a wider range of cloud-based tools in recent years with a focus on security and privacy. That began with the launch…
Exploits, Global Security News
ThreatsDay Bulletin: Wi-Fi Hack, npm Worm, DeFi Theft, Phishing Blasts— and 15 More Stories
Think your Wi-Fi is safe? Your coding tools? Or even your favorite financial apps? This week proves again how hackers, companies, and governments are all locked in a nonstop race to outsmart each other. Here’s a quick rundown of the latest cyber stories that show how fast the game keeps changing. DeFi exploit drains funds…
AI, API security, Apps, Exploits, Global Security News, Risk Management
Wallarm Halts Remote Code Execution Exploits: Defense for Vulnerable React Server Component Workflows
On December 3, 2025, React maintainers disclosed a critical unauthenticated remote code execution (RCE) vulnerability in React Server Components (RSC), tracked as CVE-2025-55182. A working PoC was released publicly, and Wallarm immediately began observing widespread exploitation attempts across customer environments. What is CVE-2025-55182? CVE-2025-55182 is an unauthenticated remote code execution (RCE) vulnerability, rated CVSS 10.0,…
AI, API security, Apps, Exploits, Global Security News, Risk Management
Wallarm Halts Remote Code Execution Exploits: Defense for Vulnerable React Server Component Workflows
On December 3, 2025, React maintainers disclosed a critical unauthenticated remote code execution (RCE) vulnerability in React Server Components (RSC), tracked as CVE-2025-55182. A working PoC was released publicly, and Wallarm immediately began observing widespread exploitation attempts across customer environments. What is CVE-2025-55182? CVE-2025-55182 is an unauthenticated remote code execution (RCE) vulnerability, rated CVSS 10.0,…
AI, API security, Apps, Exploits, Global Security News, Risk Management
Wallarm Halts Remote Code Execution Exploits: Defense for Vulnerable React Server Component Workflows
On December 3, 2025, React maintainers disclosed a critical unauthenticated remote code execution (RCE) vulnerability in React Server Components (RSC), tracked as CVE-2025-55182. A working PoC was released publicly, and Wallarm immediately began observing widespread exploitation attempts across customer environments. What is CVE-2025-55182? CVE-2025-55182 is an unauthenticated remote code execution (RCE) vulnerability, rated CVSS 10.0,…
AI, API security, Apps, Exploits, Global Security News, Risk Management
Wallarm Halts Remote Code Execution Exploits: Defense for Vulnerable React Server Component Workflows
On December 3, 2025, React maintainers disclosed a critical unauthenticated remote code execution (RCE) vulnerability in React Server Components (RSC), tracked as CVE-2025-55182. A working PoC was released publicly, and Wallarm immediately began observing widespread exploitation attempts across customer environments. What is CVE-2025-55182? CVE-2025-55182 is an unauthenticated remote code execution (RCE) vulnerability, rated CVSS 10.0,…
AI, API security, Apps, Exploits, Global Security News, Risk Management
Wallarm Halts Remote Code Execution Exploits: Defense for Vulnerable React Server Component Workflows
On December 3, 2025, React maintainers disclosed a critical unauthenticated remote code execution (RCE) vulnerability in React Server Components (RSC), tracked as CVE-2025-55182. A working PoC was released publicly, and Wallarm immediately began observing widespread exploitation attempts across customer environments. What is CVE-2025-55182? CVE-2025-55182 is an unauthenticated remote code execution (RCE) vulnerability, rated CVSS 10.0,…
Exploits, Global Security News
Developers urged to immediately upgrade React, Next.js
Developers using the React 19 library for building application interfaces are urged to immediately upgrade to the latest version because of a critical vulnerability that can be easily exploited by an attacker to remotely run their own code. Researchers at Wiz said Wednesday that a vulnerability in the React Server Components (RSC) Flight protocol affects…
Exploits, Global Security News
RCE flaw in OpenAI’s Codex CLI highlights new risks to dev environments
In a new example of how AI tools expand the attack surface of development machines, researchers found a serious remote code execution flaw in OpenAI’s Codex CLI, one of the most popular LLM-powered coding agents. “This vulnerability enables silent, repeatable remote code execution in any environment where developers run codex against a repository,” researchers from…
Breaking News, Exploits, Global Security News, hacking, information security news, Security
King Addons flaw lets anyone become WordPress admin
Hackers are exploiting a King Addons flaw (CVE-2025-8489) that lets anyone register and instantly gain admin privileges on WordPress sites. Hackers are exploiting a critical vulnerability, tracked as CVE-2025-8489 (CVSS score of 9.8), in the WordPress plugin King Addons for Elementor that allows unauthenticated users to create admin accounts via a registration privilege bug. King…
Exploits, Global Security News, Security
Critical flaw in WordPress add-on for Elementor exploited in attacks
Attackers are exploiting a critical-severity privilege escalation vulnerability (CVE-2025-8489) in the King Addons for Elementor plugin for WordPress, which lets them obtain administrative permissions during the registration process. […]
Cybercrime, Cybersecurity, Exploits, Global Security News, Meta, Research, Threats
Developers scramble as critical React flaw threatens major apps
Security researchers and code developers are scrambling to patch and investigate a critical vulnerability affecting React Server Components, an open-source library used widely across the internet and embedded into many essential software frameworks. The rapid response underscores the potential consequences of exploitation. Although no attacks have been observed or reported, researchers expect them soon and…
Breaking News, cyber crime, data breach, Exploits, Global Security News, hacking, Security
University of Pennsylvania and University of Phoenix disclose data breaches
The University of Pennsylvania and the University of Phoenix confirm they were hit in the Oracle E-Business Suite hacking campaign. The University of Pennsylvania (Penn) and the University of Phoenix confirmed they were hit in the recent cyberattack targeting Oracle E-Business Suite customers. Penn explained that it uses Oracle’s E-Business Suite (EBS) platform for supplier…
Exploits, Global Security News
Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution
A maximum-severity security flaw has been disclosed in React Server Components (RSC) that, if successfully exploited, could result in remote code execution. The vulnerability, tracked as CVE-2025-55182, carries a CVSS score of 10.0. It allows “unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints,” the…
Exploits, Global Security News
Microsoft Silently Patches Windows LNK Flaw After Years of Active Exploitation
Microsoft has silently plugged a security flaw that has been exploited by several threat actors since 2017 as part of the company’s November 2025 Patch Tuesday updates, according to ACROS Security’s 0patch. The vulnerability in question is CVE-2025-9491 (CVSS score: 7.8/7.0), which has been described as a Windows Shortcut (LNK) file UI misinterpretation vulnerability that…
Exploits, Global Security News
WordPress King Addons Flaw Under Active Attack Lets Hackers Make Admin Accounts
A critical security flaw impacting a WordPress plugin known as King Addons for Elementor has come under active exploitation in the wild. The vulnerability, CVE-2025-8489 (CVSS score: 9.8), is a case of privilege escalation that allows unauthenticated attackers to grant themselves administrative privileges by simply specifying the administrator user role during registration. It affects versions
Exploits, Global Security News, Microsoft, Security
Microsoft mitigates Windows LNK flaw exploited as zero-day
Microsoft has silently mitigated a high-severity Windows LNK vulnerability exploited by multiple state-backed and cybercrime hacking groups in zero-day attacks. […]
Artificial Intelligence, Exploits, Global Security News
Get poetic in prompts and AI will break its guardrails
Poetry can be a perplexing art form for humans to decipher at times, and apparently AI is being tripped up by it too. Researchers from Icaro Lab (part of the ethical AI company DexAI), Sapienza University of Rome, and Sant’Anna School of Advanced Studies have found that, when delivered a poetic prompt, AI will break its…
AI, API security, Data Breaches, Endpoint, Exploits, Global Security News, Network Security, Risk Management
Attackers Don’t Need to Breach Your API -They’ll Breach the Tools That Touch It
The API supply chain is the new security blind spot. Attackers no longer need to breach your APIs directly; they can target the third-party services that connect to them. These unmanaged dependencies are now the shortest path to your sensitive data. The recent Mixpanel incident is a stark reminder of that fact. What Happened During…
AI, API security, Data Breaches, Endpoint, Exploits, Global Security News, Network Security, Risk Management
Attackers Don’t Need to Breach Your API -They’ll Breach the Tools That Touch It
The API supply chain is the new security blind spot. Attackers no longer need to breach your APIs directly; they can target the third-party services that connect to them. These unmanaged dependencies are now the shortest path to your sensitive data. The recent Mixpanel incident is a stark reminder of that fact. What Happened During…
AI, API security, Data Breaches, Endpoint, Exploits, Global Security News, Network Security, Risk Management
Attackers Don’t Need to Breach Your API -They’ll Breach the Tools That Touch It
The API supply chain is the new security blind spot. Attackers no longer need to breach your APIs directly; they can target the third-party services that connect to them. These unmanaged dependencies are now the shortest path to your sensitive data. The recent Mixpanel incident is a stark reminder of that fact. What Happened During…
AI, API security, Data Breaches, Endpoint, Exploits, Global Security News, Network Security, Risk Management
Attackers Don’t Need to Breach Your API -They’ll Breach the Tools That Touch It
The API supply chain is the new security blind spot. Attackers no longer need to breach your APIs directly; they can target the third-party services that connect to them. These unmanaged dependencies are now the shortest path to your sensitive data. The recent Mixpanel incident is a stark reminder of that fact. What Happened During…
AI, API security, Data Breaches, Endpoint, Exploits, Global Security News, Network Security, Risk Management
Attackers Don’t Need to Breach Your API -They’ll Breach the Tools That Touch It
The API supply chain is the new security blind spot. Attackers no longer need to breach your APIs directly; they can target the third-party services that connect to them. These unmanaged dependencies are now the shortest path to your sensitive data. The recent Mixpanel incident is a stark reminder of that fact. What Happened During…
Exploits, Global Security News
AI, automation, and integration: The foundation for cyber protection in 2026
Cyber protection grew more complex in 2025 as more threat actors turned to artificial intelligence (AI) to increase their speed, scale, and precision. These autonomous ransomware, phishing, and data exfiltration attacks outpaced legacy tools and exploited gaps between security and backup solutions. In 2026, organizations will have to evolve just as quickly, using AI and…
Breaking News, Exploits, Global Security News, hacking, India, Laws and regulations, Mobile
India mandates SIM-linked messaging apps to fight rising fraud
India ordered messaging apps to work only with active SIM cards linked to users’ phone numbers to curb fraud and misuse. India’s Department of Telecommunications (DoT) now requires providers of messaging apps to work only with active SIM cards linked to users’ numbers to prevent fraud and misuse. “The Department of Telecommunications (DoT) has observed that some…
Enterprise Buyer’s Guides, Generative AI, Security Software, Exploits, Global Security News
Security-Tools für KI-Infrastrukturen – ein Kaufratgeber
Tools, die die KI-Infrastruktur unter die Lupe nehmen, optimieren und absichern, liegen im Trend. Unser Ratgeber führt Sie zur richtigen AI-Security-Posture-Management-Lösung. Julien Tromeur | shutterstock.com Weil sich Generative-AI-Lösungen branchenübergreifend verbreiten, wächst das Sicherheitsbedürfnis der Anwender. Diesem gerecht zu werden, ist vor allem deshalb eine Challenge, weil die Technologie enormen Einfluss auf die IT-Infrastruktur und die Unternehmensdaten nimmt.…
Exploits, Global Security News
Get poetic in prompts and AI will break its guardrails
Poetry can be a perplexing art form for humans to decipher at times, and apparently AI is being tripped up by it too. Researchers from Icaro Lab (part of the ethical AI company DexAI), Sapienza University of Rome, and Sant’Anna School of Advanced Studies have found that, when delivered a poetic prompt, AI will break…
Breaking News, CISA, Exploits, Global Security News, hacking, hacking news, Security
U.S. CISA adds Android Framework flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Android Framework flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Android Framework flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: CVE-2025-48572 Android Framework Privilege Escalation Vulnerability CVE-2025-48633 Android Framework Information Disclosure Vulnerability This week,…
california, Cybercrime, Cybersecurity, Exploits, Global Security News, Ransomware, Threats
University of Pennsylvania joins growing pool of Oracle customers impacted by Clop attacks
The University of Pennsylvania joined the steadily growing number of victim organizations impacted by the widespread data theft and extortion campaign involving a notorious ransomware group’s exploitation of a zero-day vulnerability and other defects in Oracle E-Business Suite earlier this year. The university filed a data breach notification in Maine Monday, confirming nearly 1,500 Maine…
Exploits, Global Security News
Newly discovered malicious extensions could be lurking in enterprise browsers
A sprawling surveillance campaign targeting Google Chrome and Microsoft Edge users is just the latest evolution of a seven-year-long project to distribute malicious browser extensions. By targeting trusted browser extensions and weaponizing them only after they had passed initial acceptance checks and gained a broad following, sometimes over years, a group that Koi has labelled…
Exploits, Global Security News
Newly discovered malicious extensions could be lurking in enterprise browsers
A sprawling surveillance campaign targeting Google Chrome and Microsoft Edge users is just the latest evolution of a seven-year-long project to distribute malicious browser extensions. By targeting trusted browser extensions and weaponizing them only after they had passed initial acceptance checks and gained a broad following, sometimes over years, a group that Koi has labelled…
Exploits, Global Security News
ShadyPanda’s Seven-Year Campaign Infects 4.3M Chrome and Edge Users
Infected 4.3 million Chrome and Edge users via extensions; ShadyPanda exploited browser marketplaces
Exploits, Global Security News, Google, Mobile, Security
Google fixes two Android zero days exploited in attacks, 107 flaws
Google has released the December 2025 Android security bulletin, addressing 107 vulnerabilities, including two flaws actively exploited in targeted attacks. […]
Exploits, Global Security News
Cyber Startup Frenetik Launches with Patented Deception Technology That Bets Against the AI Arms Race
While most cybersecurity companies pour resources into AI models, massive compute, hoovering up all the data, and enhanced analytics to detect and prevent threats, Frenetik, a Maryland cyber startup, is betting on something simpler: making sure attackers don’t know what defenders know. The company emerged today with a fundamentally different approach using novel cyber deception…
Exploits, Global Security News
Google Releases Patches for Android Zero-Day Flaws Exploited in the Wild
Google said it found indications that two newly identified vulnerabilities affecting Android “may be under limited, targeted exploitation”
Android, Breaking News, Exploits, Global Security News, hacking, Mobile, Security
Google’s latest Android security update fixes two actively exploited flaws
Google’s latest Android security update fixes 107 flaws across multiple components, including two vulnerabilities actively exploited in the wild. Google’s new Android update patches 107 vulnerabilities, including two already exploited in the wild, across system, kernel, and major vendor components. Here’s a concise summary under 160 characters: December’s Android update offers two patch levels (12-01,…
Exploits, Global Security News
Google Patches 107 Android Flaws, Including Two Framework Bugs Exploited in the Wild
Google on Monday released monthly security updates for the Android operating system, including two vulnerabilities that it said have been exploited in the wild. The patch addresses a total of 107 security flaws spanning different components, including Framework, System, Kernel, as well as those from Arm, Imagination Technologies, MediaTek, Qualcomm, and Unison. The two high-severity…
Bitcoin, Breaking News, cyber crime, Exploits, Global Security News
Law enforcement shuts down Cryptomixer in major crypto crime takedown
Authorities seized $29M in Bitcoin after takedown of Cryptomixer, a service used to launder cybercrime proceeds. Europol announced the seizure of $29M in Bitcoin after shutting down Cryptomixer, a crypto-mixing service used for cybercrime and money laundering. The Europol reported that since its creation in 2016, Cryptomixer mixed over EUR 1.3 billion in Bitcoin. The…
Exploits, Global Security News
[Guest Diary] Hunting for SharePoint In-Memory ToolShell Payloads, (Tue, Dec 2nd)
[This is a Guest Diary by James Woodworth, an ISC intern as part of the SANS.edu Bachelor’s Degree in Applied Cybersecurity (BACS) program [1]. In July 2025, many of us were introduced to the Microsoft SharePoint exploit chain known as ToolShell. ToolShell exploits the deserialization and authentication bypass vulnerabilities, CVE-2025-53770 [2] and CVE-2025-53771 [3], in…
Android, Cybersecurity, Cybersecurity and Infrastructure Security Agency (CISA), Exploits, Global Security News, Google, Technology
Google addresses 107 Android vulnerabilities, including two zero-days
Google disclosed two actively exploited zero-day vulnerabilities Monday, which it addressed among a total of 107 defects in the company’s monthly security update for Android devices. The zero-days — CVE-2025-48633 and CVE-2025-48572 — are both high-severity defects affecting the Android framework, which attackers can exploit to access information and escalate privileges, respectively. Google said both…
Exploits, Global Security News, Security
What are zero-day attacks and why do they work?
Zero-day attacks have become a significant concern in the realm of cybersecurity, posing a formidable challenge to individuals and organizations alike. These attacks exploit vulnerabilities that are unknown to the software vendor, leaving systems exposed to potential breaches. As cyberthreats evolve, understanding zero-day attacks and implementing effective protection strategies is crucial for maintaining security. Understanding zero-day attacks…
Exploits, Global Security News, Security
The first line of defense is still the network. But that’s only the beginning
For years, the security industry has been captivated by the promises of new acronyms: EDR, XDR, CDR. Each wave has promised broader coverage, better detection, and faster responses. And although each of these tools provides value, recent research from Enterprise Strategy Group (ESG) reveals something the industry conversation often overlooks: When real threats emerge, organizations…