Hackers are uploading fake resumes on Indeed and JazzHR to breach Canadian companies.

80% of attacks in this campaign hit Canada.

The “PDFs” actually launch QWCrypt ransomware through a tool called RedLoader.

Researchers found malicious packages in VS Code, Go, npm, and Rust stealing developer data.

They mimicked themes, AI tools, and libraries to grab screenshots, Wi-Fi passwords, and browser cookies.

Microsoft Patches 57 Vulnerabilities, Three Zero-Days.

SAP fixes three critical vulnerabilities across multiple products.

Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure.

New Spiderman Phishing Kit Targets European Banks with Real-Time Credential Theft.

Fortinet, Ivanti, and SAP Issue Urgent Patches for Authentication and Code Execution Flaws.

Switzerland’s Federal Office for Armaments, Armasuisse, reviewed Palantir’s proposal for a major IT upgrade to its military intelligence systems and flagged significant risks. The assessment warned that the company’s US headquarters, proprietary platforms, and reliance on on-site engineers could expose Swiss data to American authorities. It also raised concerns about the privacy implications of Palantir’s expansive data-analysis capabilities.

Hackers are hiding inside Google Drive.

Researchers found a Windows backdoor called NANOREMOTE that uses the Google Drive API to steal files and run commands.

It even pretends to be Bitdefender software so it looks safe.

Hackers are still hitting Middle East governments.

A group called WIRTE (Ashen Lepus) is expanding to Oman and Morocco with new malware named AshTag.

It hides in fake political PDFs — open one, and it steals your files.

700+ Gogs servers hacked — no patch yet.

New flaw (CVE-2025-8110) lets attackers overwrite files and run code through symbolic links, bypassing last year’s fix.

Wiz found Supershell malware — often used by Chinese groups — on many hacked servers.

Hackers are attacking CentreStack and Triofox right now using a built-in key that never changes.

It lets them break in, read the web.config file, and run code on the server.

At least 9 companies have already been hit.

New: React2Shell attacks are surging.

Hackers are exploiting a critical RSC flaw (CVE-2025-55182) to install crypto miners and new malware — PeerBlight, CowTunnel, and ZinFoq.

A .NET flaw called “SOAPwn” lets hackers run code on enterprise apps — no patch from Microsoft.

Researchers at Black Hat Europe showed how SOAP clients can be tricked into writing files or web shells, hitting tools like Barracuda RMM and Ivanti EPM.

[New] React just found more bugs hiding in its last big patch.

CVE-2025-55184 & CVE-2025-67779 — can crash servers with one request.
CVE-2025-55183 — can leak source code from React Server Components.

All discovered while testing the earlier CVE-2025-55182 fix.

Update to versions 19.0.3, 19.1.4, or 19.2.3 now.

Over 137,000 servers are wide open.

Hackers are using the React2Shell bug (CVE-2025-55182) to take over web servers — no password needed.

Even U.S. government sites are being hit, and the attacks are spreading fast through Next.js apps online.

CISA just confirmed active exploitation of a new GeoServer flaw (CVE-2025-58360).

It’s unauthenticated — the /geoserver/wms endpoint can be abused to access files or hit internal systems if not patched.

Tails 7.2 is out:

It includes Tor Browser 15.0, based on Firefox 140, which improves tab management with vertical tabs and tab groups.

Today's browser update (v1.85.116) contains a fix for a Chromium vulnerability found to be exploited in the wild.

Microsoft promises more bug payouts, with or without a bounty program.

New Advanced Phishing Kits Use AI and MFA Bypass Tactics to Steal Credentials at Scale.