A .NET flaw called “SOAPwn” lets hackers run code on enterprise apps — no patch from Microsoft.

Researchers at Black Hat Europe showed how SOAP clients can be tricked into writing files or web shells, hitting tools like Barracuda RMM and Ivanti EPM.

[New] React just found more bugs hiding in its last big patch.

CVE-2025-55184 & CVE-2025-67779 — can crash servers with one request.
CVE-2025-55183 — can leak source code from React Server Components.

All discovered while testing the earlier CVE-2025-55182 fix.

Update to versions 19.0.3, 19.1.4, or 19.2.3 now.

Over 137,000 servers are wide open.

Hackers are using the React2Shell bug (CVE-2025-55182) to take over web servers — no password needed.

Even U.S. government sites are being hit, and the attacks are spreading fast through Next.js apps online.

CISA just confirmed active exploitation of a new GeoServer flaw (CVE-2025-58360).

It’s unauthenticated — the /geoserver/wms endpoint can be abused to access files or hit internal systems if not patched.

Tails 7.2 is out:

It includes Tor Browser 15.0, based on Firefox 140, which improves tab management with vertical tabs and tab groups.

Today's browser update (v1.85.116) contains a fix for a Chromium vulnerability found to be exploited in the wild.

Microsoft promises more bug payouts, with or without a bounty program.

New Advanced Phishing Kits Use AI and MFA Bypass Tactics to Steal Credentials at Scale.

Fieldtex Data Breach Impacts 238,000.

MKVCinemas streaming piracy service with 142M visits shuts down.

Apple patched two bugs hackers were already using. New updates fix active attacks across iPhone, iPad, Mac, Safari, Watch, TV, and Vision Pro.

One bug lets attackers run code from bad web pages.
Another breaks memory.
All iPhone and iPad browsers were affected.
Apple says the attacks were highly targeted.

This is Apple’s 9th zero-day fix in 2025.

Researchers found fake Python tools on GitHub spreading a new trojan called PyStoreRAT.

The repos look real, gain stars ⭐, and run hidden malware using a Windows tool.

The malware can steal crypto wallet files and stay hidden by pretending to be an NVIDIA update.

Hackers are attacking CentreStack and Triofox right now using a built-in key that never changes.

It lets them break in, read the web-config file, and run code on the server.

At least 9 companies have already been hit.

CISA Adds Actively Exploited Sierra Wireless Router Flaw Enabling RCE Attacks

The addition of CVE-2018-4063 to the KEV catalog comes a day after a honeypot analysis conducted by Forescout over a 90-day period revealed that industrial routers are the most attacked devices in operational technology (OT) environments, with threat actors attempting to deliver botnet and cryptocurrency miner malware families like RondoDox, Redtail, and ShadowV2 by exploiting the following flaws -

CVE-2024-12856 (Four-Faith routers)
CVE-2024-0012, CVE-2024-9474, and CVE-2025-0108 (Palo Alto Networks PAN-OS)

Germany calls in Russian Ambassador over air traffic control hack claims.

Fake OSINT and GPT Utility GitHub Repos Spread PyStoreRAT Malware Payloads.

Coupang data breach traced to ex-employee who retained system access.

Fake ‘One Battle After Another’ torrent hides malware in subtitles.

Google ads funnel Mac users to poisoned AI chats that spread the AMOS infostealer.