More than 70,000 WatchGuard Firebox devices remain exposed online, according to security researchers who warn of a critical remote code execution (RCE) vulnerability. The flaw could allow attackers to seize full control of affected WatchGuard firewalls, exposing devices to unauthorized access and potential network compromise. The discovery highlights the ongoing risk for organizations that have […]
Cybersecurity researchers have identified a phishing-as-a-service toolkit known as the Tykit phishing kit targeting Microsoft 365 credentials. The kit uses a distinct approach by embedding a scalable vector graphics (SVG) image to redirect victims to spoofed login pages, increasing the likelihood of deception. Investigators believe this technique helps attackers bypass standard email security filters, allowing […]
The developers behind Vidar Stealer, a prominent malware-as-a-service platform, have launched a major update that significantly enhances its capabilities. The Vidar Stealer 2.0 upgrades introduce multi-threaded data theft, allowing the malware to exfiltrate information more efficiently from infected systems. Security analysts say this version marks a notable leap in both performance and stealth. In addition […]
WSO2 has issued critical security advisories to address two severe access control vulnerabilities—CVE-2025-9804 and CVE-2025-10611—impacting its API Manager and Identity Server products. The company moved quickly after identifying the flaws, which could allow unauthorized access to sensitive enterprise systems. These WSO2 patches for critical flaws aim to prevent potential exploitation in production environments. The vulnerabilities […]
China-based cybersecurity firm Qianxin Threat Intelligence Center has identified a new cyber campaign targeting Chinese and Pakistani entities. The attackers, linked to the Bitter APT Hits China group (APT-Q-37), used a zero-day vulnerability in WinRAR along with malicious Microsoft Office macros to deploy a custom C# backdoor. The tools allowed the threat actor to gain […]
ABB has confirmed a critical security flaw in its ALS-mini-S4 and S8 IP intelligent load controllers, exposing energy infrastructure to serious risk. Tracked as CVE-2025-9574 and rated 9.9 on the CVSS scale, the vulnerability stems from missing authentication, allowing remote attackers to gain admin-level access without credentials. The ABB flaw lets hackers fully control these […]
Swiss building automation firm Sauter AG has identified six security vulnerabilities in the firmware of its modulo 6 devices, including a critical flaw rated 9.8 on the CVSS scale. The most severe vulnerability, tracked as CVE-2025-41723, allows unauthenticated attackers to upload files remotely via the system’s SOAP interface. The Sauter AG flaw letsnaturally threat actors […]
Google has issued an urgent Stable Channel update for Chrome on Windows, Mac, and Linux platforms, addressing a high-severity vulnerability in its V8 JavaScript engine. The flaw, tracked as CVE-2025-12036, could allow attackers to exploit memory-related weaknesses in the engine. The latest Google Chrome patch fixes this critical issue in version 141.0.7390.122/.123, and users are […]
OpenAI has intensified competition in the AI browser sector with the launch of ChatGPT Atlas, an AI-powered web browser designed to reshape how users interact online. OpenAI challenges Google’s dominance by integrating its advanced conversational AI directly into the browsing experience, signaling a strategic shift toward intelligent, adaptive web tools. The browser war is escalating […]