A newly disclosed vulnerability in Microsoft’s Cloud Files Minifilter driver, tracked as CVE-2025-55680, poses a significant elevation-of-privilege risk to all supported versions of Windows. Researchers from Exodus Intelligence revealed technical details of the flaw, which stems from the cldflt.sys driver used in cloud file operations. The Microsoft Cloud Files bug enables attackers with local access […]
Security researcher Crnkovic has revealed three critical vulnerabilities in WSO2 API Manager and WSO2 Identity Server, each carrying a CVSS score of 9.8. The flaws—cataloged as CVE-2025-9152, CVE-2025-10611, and CVE-2025-9804—allow attackers to bypass authentication mechanisms. These WSO2 flaws expose critical weaknesses in systems widely used for identity and access management across enterprise environments. The vulnerabilities […]
A newly disclosed security flaw in Dovecot, a widely used open-source IMAP and POP3 email server, may allow unauthorized access to user accounts due to a mismanaged authentication cache. The vulnerability, tracked as CVE-2025-30189, was disclosed on the Full Disclosure mailing list. The Dovecot flaw lets users inadvertently access other users’ accounts when cached authentication […]
Google has released Chrome version 142 to the stable channel for Windows, Mac, and Linux, patching 20 security vulnerabilities that could impact millions of users. The Google Chrome 142 fixes arrive as part of an urgent update, addressing critical flaws and enhancing browser security across all desktop platforms. The update, identified as version 142.0.744, aims […]
The Wordfence Threat Intelligence team has issued an urgent advisory about active exploitation of a critical vulnerability in the WP Freeio plugin for WordPress. Tracked as CVE-2025-11533, the flaw carries a CVSS score of 9.8 and enables privilege escalation, allowing attackers to take over vulnerable sites. Wordfence alerts to WP Freeio users emphasize the severity […]
The Internet Systems Consortium has released a patch for a high-severity vulnerability in the Kea DHCPv4 server that could allow attackers to crash the service using a specially crafted hostname. Tracked as CVE-2025-11232 and rated 7.5 on the CVSS scale, the flaw poses a significant risk to network stability. ISC fixes Kea DHCPv4 bug in […]
The Jenkins project on Thursday issued a critical security advisory revealing multiple vulnerabilities in its plugin ecosystem, including a serious authentication bypass affecting SAML-based logins. Jenkins hit by plugin flaws now faces heightened risks to server integrity and user confidentiality, with attackers potentially gaining unauthorized access through compromised modules. Among the identified issues is CVE-2025-64131, […]
The Cybersecurity and Infrastructure Security Agency (CISA) released updated threat detection guidance on October 29, 2025, addressing the actively exploited Windows Server Update Services (WSUS) vulnerability tracked as CVE-2025-59287. The alert comes after CISA warns of active hacks targeting this flaw, urging organizations to strengthen monitoring and apply mitigations immediately. The agency detailed new indicators […]
A widespread Microsoft Azure 365 outage has disrupted services across multiple sectors, just days after a similar issue affected Amazon Web Services. The back-to-back incidents have intensified concerns about the public sector’s heavy dependence on a few dominant cloud platforms. With key systems increasingly hosted in the cloud, the impact of such disruptions can ripple […]
Clearview AI sued in Europe as the facial recognition firm faces renewed legal pressure over alleged violations of data privacy laws. The complaint, filed by the advocacy group noyb, accuses Clearview of ignoring previous bans and enforcement actions issued by European data protection authorities. These regulators had previously ruled that the company’s data collection practices […]
Hackers combine cache FileFix techniques in a new phishing campaign that uses deceptive FortiClient pages and browser caching to bypass detection. Cybersecurity analysts found that attackers trick users into pasting commands into Windows Explorer’s address bar, exploiting a 2048-character entry limit to deliver larger payloads than possible in traditional ClickFix attacks. The campaign hides PowerShell […]
Japanese advertising conglomerate Dentsu has confirmed a cybersecurity breach at its U.S.-based subsidiary Merkle, exposing sensitive information belonging to employees and clients. Dentsu discloses data breach details following an internal investigation that identified unauthorized access to company systems. The company has not confirmed the number of affected individuals or the nature of the compromised data. […]