Hackers found a new way to phish — through browser notifications.
A new tool called Matrix Push C2 lets attackers send fake alerts that look like real ones from PayPal, Netflix, or TikTok.
No downloads. No malware file. Just one click — and your data’s theirs.
A new tool called Matrix Push C2 lets attackers send fake alerts that look like real ones from PayPal, Netflix, or TikTok.
No downloads. No malware file. Just one click — and your data’s theirs.
CISA warns Oracle Identity Manager flaw (CVE-2025-61757) is under active attack.
Hackers can run code without login by adding ?WSDL or ;.wadl to URLs — a tiny trick that opens locked systems.
Exploited since August. Patch by Dec 12.
Hackers can run code without login by adding ?WSDL or ;.wadl to URLs — a tiny trick that opens locked systems.
Exploited since August. Patch by Dec 12.
Hackers are using a fixed Windows bug (CVE-2025-59287) to spread ShadowPad malware through WSUS servers.
They used normal Windows tools like curl and certutil to install it — a method seen before in Chinese hacking groups.
Systems patched too late may have already been compromised.
They used normal Windows tools like curl and certutil to install it — a method seen before in Chinese hacking groups.
Systems patched too late may have already been compromised.
Researchers say China’s DeepSeek-R1 AI writes weaker code when asked about topics like Tibet or Uyghurs.
Coding mistakes go up by about 50%, even when the topic isn’t part of the task.
This bias could be a new security risk.
Coding mistakes go up by about 50%, even when the topic isn’t part of the task.
This bias could be a new security risk.
The attacker targeted Windows Servers with WSUS enabled, exploiting CVE-2025-59287 for initial access.
North Korean APT duo join forces: Kimsuky acts as the "eyes" to steal intelligence, while Lazarus steals cryptocurrency to fill the "money bag"!
A critical security flaw (CVE-2025-11001) in 7-Zip has a public exploit. Learn why this high-risk vulnerability is dangerous and how to manually update to version 25.01 now.
NSO seeks to overturn WhatsApp case, saying it is ‘catastrophic’ for the spyware maker.
Matrix Push C2 Uses Browser Notifications for Fileless, Cross-Platform Phishing Attacks.
CVE-2025-61757 is a pre-authentication RCE vulnerability in Oracle Identity Manager, discovered and disclosed by Searchlight Cyber analysts Adam Kues and Shubham Shahflaw.
New npm attack DETECTED!
A campaign dubbed “Sha1-Hulud: The Second Coming” has compromised hundreds of packages and over 25,000 GitHub repos.
The code runs during install, steals cloud logins, and if that fails, it deletes the user’s home folder.
A campaign dubbed “Sha1-Hulud: The Second Coming” has compromised hundreds of packages and over 25,000 GitHub repos.
The code runs during install, steals cloud logins, and if that fails, it deletes the user’s home folder.
The security defects "allow attackers to bypass authentication, perform path traversal, achieve remote code execution, cause denial-of-service conditions, and manipulate tags,"
Successful exploitation of the flaws could enable attackers to disrupt cloud services, manipulate data, and burrow deeper into cloud and Kubernetes infrastructure. The list of identified vulnerabilities is as follows -
CVE-2025-12972 - A path traversal vulnerability stemming from the use of unsanitized tag values to generate output filenames, making it possible to write or overwrite arbitrary files on disk, enabling log tampering and remote code execution.
CVE-2025-12970 - A stack buffer overflow vulnerability in the Docker Metrics input plugin (in_docker) that could allow attackers to trigger code execution or crash the agent by creating containers with excessively long names.
CVE-2025-12978 - A vulnerability in the tag-matching logic lets attackers spoof trusted tags – which are assigned to every event ingested by Fluent Bit – by guessing only the first character of a Tag_Key, allowing an attacker to reroute logs, bypass filters, and inject malicious or misleading records under trusted tags.
CVE-2025-12977 - An improper input validation of tags derived from user-controlled fields, allowing an attacker to inject newlines, traversal sequences, and control characters that can corrupt downstream logs.
CVE-2025-12969 - A missing security.users authentication in the in_forward plugin that's used to receive logs from other Fluent Bit instances using the Forward protocol, allowing attackers to send logs, inject false telemetry, and flood a security product's logs with false events.
Successful exploitation of the flaws could enable attackers to disrupt cloud services, manipulate data, and burrow deeper into cloud and Kubernetes infrastructure. The list of identified vulnerabilities is as follows -
CVE-2025-12972 - A path traversal vulnerability stemming from the use of unsanitized tag values to generate output filenames, making it possible to write or overwrite arbitrary files on disk, enabling log tampering and remote code execution.
CVE-2025-12970 - A stack buffer overflow vulnerability in the Docker Metrics input plugin (in_docker) that could allow attackers to trigger code execution or crash the agent by creating containers with excessively long names.
CVE-2025-12978 - A vulnerability in the tag-matching logic lets attackers spoof trusted tags – which are assigned to every event ingested by Fluent Bit – by guessing only the first character of a Tag_Key, allowing an attacker to reroute logs, bypass filters, and inject malicious or misleading records under trusted tags.
CVE-2025-12977 - An improper input validation of tags derived from user-controlled fields, allowing an attacker to inject newlines, traversal sequences, and control characters that can corrupt downstream logs.
CVE-2025-12969 - A missing security.users authentication in the in_forward plugin that's used to receive logs from other Fluent Bit instances using the Forward protocol, allowing attackers to send logs, inject false telemetry, and flood a security product's logs with false events.
NEW - EU reportedly plans to pass the controversial "Chat Control" legislation "without discussion" behind closed doors.
The Tor Project upgrading #relay encryption algorithm for improved security. In upcoming releases, Arti and #Tor will both support a new encryption algorithm called Counter Galois Onion (CGO). CGO prevents attackers from tampering with encrypted traffic, adds forward secrecy, and brings Tor's encryption up to modern standards.
State-linked hackers are hijacking Signal, WhatsApp, and Telegram accounts using spyware disguised as real apps — some use zero-click bugs on iPhones and Androids.
Targets include diplomats and officials across the U.S., Europe, and the Middle East.
Targets include diplomats and officials across the U.S., Europe, and the Middle East.